Fix or renew SSL with Cloudflare
With Cloudflare there are two certificates: the edge certificate visitors see (Cloudflare renews it) and the origin certificate on your server (your job, or a 15-year Cloudflare Origin Certificate). Our check sees the edge one; a 525 or 526 error means the origin one.
- Difficulty
- medium
- Time
- about 15 minutes
- Last reviewed
- 2026-10-26
Is this urgent?
Edge certificate: within 24 hours. Origin certificate: as soon as 5xx errors appear.
Easy fix, no technical skills
Edge certificate: Cloudflare, SSL/TLS, Edge Certificates. Universal SSL should say Active. If not, Disable then Enable it, and make sure the domain's nameservers are Cloudflare's.
Origin certificate: Cloudflare, SSL/TLS, Origin Server, Create Certificate (15 years), install it on your server, then set the SSL mode to Full (strict).
If you cannot install an origin certificate today, set SSL mode to Full so the site works, and fix the origin later.
Hand it to your IT person
Copy this into an email or chat. Replace the brackets with the details from your alert.
example.com is behind Cloudflare. Please install a Cloudflare Origin Certificate on the origin (or renew its certificate) and confirm SSL mode Full (strict). The edge certificate status is (status).
Technical fix (commands)
Check the origin certificate directly.
echo | openssl s_client -connect ORIGIN_IP:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -issuer
Check it worked
Load the site; no 525 or 526; our SSL checker shows a Cloudflare issuer with a future date.
Check the certificate now with the free tool. All free tools.
Prevent it next time
- Use a 15-year Origin Certificate so the origin never expires on you.
- Keep nameservers at Cloudflare so Universal SSL keeps renewing.
The same fix on other platforms
Common questions
Is this urgent?
Edge certificate: within 24 hours. Origin certificate: as soon as 5xx errors appear.
Can I fix this without technical skills?
Yes. The easy fix below needs no technical skills; the commands are only for your IT person.
How long does it take?
About 15 minutes once you know who runs the website.
Hear about this before your customers do
Add your website and we check uptime, certificates, domains and email security for you, free.