Resolving Cloudflare error 525 SSL handshake failed on Origin CA setup

by

Cloudflare Error 525 (SSL Handshake Failed) occurs when the TCP connection between Cloudflare’s edge servers and the origin web server completes, but the subsequent TLS/SSL handshake fails to negotiate. When utilizing a Cloudflare Origin CA certificate, this issue stems from an incomplete certificate chain on the origin server, missing SNI (Server Name Indication) handling, mismatched TLS protocol versions, or an improper Cloudflare SSL/TLS encryption mode setting. Because Cloudflare Origin CA certificates are signed by an internal Cloudflare authority, strict verification requires correct origin server port 443 listening configuration and cipher suite compatibility.

Quick Fix

Set Cloudflare SSL/TLS encryption mode to Full (strict) in the dashboard (SSL/TLS > Overview) and run the following command to verify if your origin server completes the TLS handshake locally:

openssl s_client -connect YOUR_ORIGIN_IP:443 -servername YOURDOMAIN.COM -showcerts

Step-by-Step Resolution

  1. Generate and Install Cloudflare Origin CA Certificate: Navigate to SSL/TLS > Origin Server in Cloudflare and select Create Certificate. Save the generated public certificate and private key to secure locations on your server:
  • Certificate: /etc/ssl/certs/cloudflare_origin.pem
  • Private Key: /etc/ssl/private/cloudflare_origin.key

Restrict file permissions on the private key:

chmod 600 /etc/ssl/private/cloudflare_origin.key
  1. Configure Web Server Directives: Update your primary web server configuration to handle port 443 requests using the installed certificate files.

For Nginx (/etc/nginx/conf.d/yourdomain.conf):

server {
    listen 443 ssl http2;
    server_name yourdomain.com www.yourdomain.com;

    ssl_certificate /etc/ssl/certs/cloudflare_origin.pem;
    ssl_certificate_key /etc/ssl/private/cloudflare_origin.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

For Apache (/etc/httpd/conf.d/yourdomain.conf or /etc/apache2/sites-available/yourdomain.conf):

<VirtualHost *:443>
    ServerName yourdomain.com
    ServerAlias www.yourdomain.com

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/cloudflare_origin.pem
    SSLCertificateKeyFile /etc/ssl/private/cloudflare_origin.key

    SSLProtocol -all +TLSv1.2 +TLSv1.3
</VirtualHost>
  1. Test Configuration Syntax and Reload Services: Validate configuration syntax for errors before restarting web server daemons:
# For Nginx
nginx -t && systemctl reload nginx

# For Apache
apachectl configtest && systemctl reload apache2
  1. Set Encryption Mode to Full (Strict): In the Cloudflare Dashboard, navigate to SSL/TLS > Overview and set the encryption mode to Full (strict). This instructs Cloudflare to validate the present Origin CA certificate on port 443 for every proxied request.
See also  Fixing LiteSpeed OpenLiteSpeed cache crawler 403 Forbidden loop

Why This Fails for Some Users

  • Missing or Mismatched SNI Configuration: Cloudflare requires SNI during the TLS handshake. If the origin server relies on a default VirtualHost configuration without an explicit server_name or ServerName directive matching the requested host on port 443, the server serves an incorrect default certificate and drops the handshake.
  • Certificate Expiration: Selecting short validity durations (e.g., 7 or 30 days) during Origin CA certificate creation without automating renewal leads to unexpected 525 errors once the certificate expires.
  • Firewall / DPI Cipher Stripping: Host firewalls (IPTables, UFW), AWS Security Groups, or hardware WAFs performing Deep Packet Inspection (DPI) can drop TLS 1.3 Client Hello packets or strip modern cipher suites sent by Cloudflare IP ranges.
  • Direct Access / Gray-Clouding: Unproxying the domain (setting DNS records to “DNS only” / gray cloud) causes web browsers to attempt direct SSL negotiation with the origin. Because Cloudflare Origin CA certificates are not trusted by public root stores, browsers reject the connection directly.

Leave a Comment