Troubleshooting SSL errors

Troubleshoot common SSL errors observed when browsing to a domain proxied through Cloudflare.


Until Cloudflare provides an SSL certificate for your domain, the following errors appear in various browsers for HTTPS traffic:


     This connection is untrusted


     Your connection is not private


     Safari can't verify the identity of the website

Edge / Internet Explorer

     There is a problem with this website's security certificate

Even with a Cloudflare SSL certificate provisioned for your domain, older browsers display errors about untrusted SSL certificates because they do not support the Server Name Indication (SNI) protocol used by Cloudflare Universal SSL certificates.  It is possible for Cloudflare Support to enable non-SNI support for domains on Pro, Business, or Enterprise plans for Universal, Dedicated, Custom, or Custom Hostname certificates.

Otherwise, if SSL errors occur when using a newer browser, review these common SSL error causes:

Redirect loop errors or HTTP 525 or 526 errors


Visitors observe redirect loop errors when browsing to your domain or observe HTTP 525 or 526 errors. These errors occur when the current Cloudflare SSL/TSL encryption mode in the Cloudflare SSL/TLS app is not compatible with your origin web server’s configuration.


For redirect loops, refer to our guide on troubleshooting redirect loop errors.

To resolve HTTP 525 or 526 errors, refer to our recommended SSL configurations below. For instance, if your origin web server…

Only some of your subdomains return SSL errors


Cloudflare Universal SSL and regular Dedicated SSL certificates only cover the root-level domain ( and one level of subdomains (* If visitors to your domain observe errors accessing a second level of subdomains in their browser (such as but not the first level of subdomains (such as, resolve the issue using one of the following methods below.


  • Ensure the domain is at least on a Business plan and upload a Custom SSL certificate that covers, or
  • purchase a Dedicated SSL certificate with Custom Hostnames that covers, or
  • if you have a valid certificate for the second level subdomains at your origin web server, click the orange cloud icon beside the dev.www hostname in the Cloudflare DNS app for

Your Cloudflare Universal SSL certificate is not active


All active Cloudflare domains are provided a Universal SSL certificate. If you observe SSL errors and do not have a certificate of Type Universal within the Edge Certificates tab of the Cloudflare SSL/TLS app for your domain, the Universal SSL certificate has not yet provisioned.

Cloudflare SSL certificates only apply for traffic proxied through Cloudflare. If SSL errors only occur for hostnames not proxied to Cloudflare, proxy those hostnames through Cloudflare:
  • For domains on Full DNS setups, click the grey cloud icon icon beside the DNS hostname in your Cloudflare DNS app until the icon becomes an orange cloud.
  • For domains on CNAME setups, review our guide on adding DNS records to a CNAME setup.

Our SSL vendors verify each SSL certificate request before Cloudflare can issue a certificate for a domain name. This process may take anywhere from 15 minutes to 24 hours. Our SSL certificate vendors sometimes flag a domain name for additional review.


If your domain is on a CNAME setup:

Confirm whether you have CAA DNS records enabled at your current hosting provider. If so, ensure you specify the Certificate Authorities that Cloudflare uses to provision certificates for your domain.

If Universal SSL is disabled on your domain under the Disable Universal SSL section of the Edge Certificates tab in Cloudflare SSL/TLS app:

If your Cloudflare SSL certificate is not issued within 24 hours of Cloudflare domain activation:

Temporarily pausing Cloudflare will allow the HTTPS traffic to be served properly from your origin web server while the support team investigates the issue.

OCSP response error


Visitors to your site observe an OCSP response error.


This error is either caused by the browser version or an issue requiring attention by one of Cloudflare’s SSL vendors. In order to properly diagnose, open a support ticket with the following information provided by the visitor that observes the browser error:

  1. The output from
  2. The output of from the visitor’s browser. Replace with your website’s domain name.

SSL expired or SSL mismatch errors


Visitors observe error messages in their browser about SSL expiration or SSL mismatch.


If you use a Custom SSL certificate, first verify that it has not expired or upload a replacement SSL certificate.

Contact Cloudflare support and provide the following information:

  • the affected domain name, and
  • a screenshot of the errors you observe.

Related resources

Not finding what you need?

95% of questions can be answered using the search tool. This is the quickest way to get a response.