This site is not affiliated with Cloudflare; this is an independent explanation.
The 525 error code means "SSL handshake failed". It comes from Cloudflare, a company that sits between visitors and many websites, and it is not an official HTTP code. It reserves a block of numbers in the 520s for its own messages.
When you open a secure site, Cloudflare first talks to you, then talks to the real server behind the site. A handshake is the short secure greeting between those two. In a 525 that greeting failed, so Cloudflare could not pass your request on. A close cousin is the 526 error code, where the server's certificate is invalid. Both are owner problems, but there are a few checks that visitors can still do.
Common causes
1No working SSL certificate on the origin server
How to tellSite worked before a server move or a new host
What fixes itOwner installs a valid certificate on the server
2Wrong SSL mode set in the dashboard
How to tellStarted right after changing the encryption setting
What fixes itOwner matches the mode to what the server really supports
3Server does not accept secure connections on port 443
How to tellPlain http works on the server but https does not
What fixes itOwner opens and configures the secure port
4Old protocol or cipher mismatch
How to tellAn outdated server setup that cannot agree on settings
What fixes itOwner updates server software and secure settings
5Certificate expired
How to tellError appears suddenly on a set date after months of working
What fixes itOwner renews the certificate and turns on auto renewal
6Firewall blocking the proxy service
How to tellOrigin is up but refuses these connections
What fixes itOwner allows the proxy service's address ranges
How to fix it, step by step
Reload once after a short wait
If the owner is mid change, the site may recover within minutes. Wait, then reload one time with F5. Do not refresh again and again.
Test on another network
Open the same address on mobile data or ask someone elsewhere to try. If the error shows for everyone, the problem is with the site's server, not with your device.
Check your date and time
A wrong clock on your phone or computer causes a different secure connection warning in the browser, not a 525. Still, set date and time to automatic to rule it out.
Try a private window
Load the site in an incognito tab, which skips saved data and add-ons. If the 525 page looks the same, it is a server side fault.
Visit later or use the app
Owners usually fix certificate trouble quickly once they know. Try again in an hour, or use the service's official app if it has one.
Tell the owner what you saw
Send the page address, the time and the Ray ID shown at the bottom of the error page. The Ray ID lets the owner find the exact failed request.
525 error code meaning in plain words
A secure site uses a short exchange, often called the SSL or TLS handshake, to agree on how to encrypt the traffic. Cloudflare plays the visitor's side in that exchange with the real server. In a 525, the origin server answered but the two sides could not finish that agreement, so the secure link never started.
You open a shop and see Error 525: SSL handshake failed with the shop's name below. The shop's pages are fine for the owner on the server, but the secure link between the server and Cloudflare is broken.
The 526 error code and invalid SSL certificate
The 526 error code is close. In a 525 the handshake fails. In a 526 the handshake works, but the certificate on the server is not valid, for example expired, issued for another name or not trusted. The fix is again the owner's: install a proper certificate that matches the site's name.
| Code | Meaning |
|---|---|
| 525 | Handshake with the server failed |
| 526 | Server certificate is invalid |
| 521 | Server refused the connection |
| 522 | Connection to the server timed out |
How site owners fix a 525
- Check that a certificate is installed on the origin and that it has not expired.
- Make sure port 443 is open and a secure site is configured for your domain on the server.
- Review the SSL mode in the dashboard. A strict mode needs a valid certificate on the server.
- Update server software so it supports current secure protocols.
- Test the server directly with a secure connection tool to see the real error.
Avoid switching to a weaker mode just to hide the error. It may stop the message but leaves traffic between the server and the proxy less safe.
Frequently asked questions
What does the 525 error code mean?
It means Cloudflare could not complete the SSL handshake with the website's server. The secure link between them failed.
Can a visitor fix error code 525?
No. Retry later and test another network, but the certificate or server settings must be corrected by the site owner.
What is the difference between 525 and 526?
In a 525 the handshake fails. In a 526 the server's certificate is invalid, such as expired or for the wrong name.
What does SSL handshake failed mean?
It means two sides could not agree on how to set up an encrypted connection, so the secure link was never made.
Is the 525 error code caused by my browser?
Very rarely. It comes from the connection between the proxy service and the site's server, not from your browser.