Troubleshooting SSL errors

Troubleshoot common SSL errors observed when browsing to a domain proxied through Cloudflare.


Overview

Until Cloudflare provides an SSL certificate for your domain, the following errors appear in various browsers for HTTPS traffic:

Firefox

     ssl_error_bad_cert_domain
     This connection is untrusted

Chrome

     Your connection is not private

Safari

     Safari can't verify the identity of the website

Edge / Internet Explorer

     There is a problem with this website's security certificate

Even with a Cloudflare SSL certificate provisioned for your domain, older browsers display errors about untrusted SSL certificates because they do not support the Server Name Indication (SNI) protocol used by Cloudflare Universal SSL certificates.

Otherwise, if SSL errors occur when using a newer browser, review these common SSL error causes:


Redirect loop errors or HTTP 525 or 526 errors

Symptom

Visitors observe redirect loop errors when browsing to your domain or observe HTTP 525 or 526 errors. These errors occur when the current Cloudflare SSL/TSL encryption mode in the Cloudflare SSL/TLS app is not compatible with your origin web server’s configuration.

Resolution

For redirect loops, refer to our guide on troubleshooting redirect loop errors.

To resolve HTTP 525 or 526 errors, refer to our recommended SSL configurations below. For instance, if your origin web server…


Only some of your subdomains return SSL errors

Symptom

Cloudflare Universal SSL and regular Dedicated SSL certificates only cover the root-level domain (example.com) and one level of subdomains (*.example.com). If visitors to your domain observe errors accessing a second level of subdomains in their browser (such as dev.www.example.com) but not the first level of subdomains (such as www.example.com), resolve the issue using one of the following methods below.

Resolution

  • Ensure the domain is at least on a Business plan and upload a Custom SSL certificate that covers dev.www.example.com, or
  • purchase a Dedicated SSL certificate with Custom Hostnames that covers dev.www.example.com, or
  • if you have a valid certificate for the second level subdomains at your origin web server, click the orange cloud icon beside the dev.www hostname in the Cloudflare DNS app for example.com.

Your Cloudflare Universal SSL certificate is not active

Symptom

All active Cloudflare domains are provided a Universal SSL certificate. If you observe SSL errors and do not have a certificate of Type Universal within the Edge Certificates tab of the Cloudflare SSL/TLS app for your domain, the Universal SSL certificate has not yet provisioned.

Cloudflare SSL certificates only apply for traffic proxied through Cloudflare. If SSL errors only occur for hostnames not proxied to Cloudflare, proxy those hostnames through Cloudflare:
  • For domains on Full DNS setups, click the grey cloud icon icon beside the DNS hostname in your Cloudflare DNS app until the icon becomes an orange cloud.
  • For domains on CNAME setups, review our guide on adding DNS records to a CNAME setup.

Our SSL vendors verify each SSL certificate request before Cloudflare can issue a certificate for a domain name. This process may take anywhere from 15 minutes to 24 hours. Our SSL certificate vendors sometimes flag a domain name for additional review.

Resolution

If your domain is on a CNAME setup:

Confirm whether you have CAA DNS records enabled at your current hosting provider. If so, ensure you specify the Certificate Authorities that Cloudflare uses to provision certificates for your domain.

If Universal SSL is disabled on your domain under the Disable Universal SSL section of the Edge Certificates tab in Cloudflare SSL/TLS app:

If your Cloudflare SSL certificate is not issued within 24 hours of Cloudflare domain activation:

Temporarily pausing Cloudflare will allow the HTTPS traffic to be served properly from your origin web server while the support team investigates the issue.


OCSP response error

Symptom

Visitors to your site observe an OCSP response error.

Resolution

This error is either caused by the browser version or an issue requiring attention by one of Cloudflare’s SSL vendors. In order to properly diagnose, open a support ticket with the following information provided by the visitor that observes the browser error:

  1. The output from https://aboutmybrowser.com/
  2. The output of https://example.com/cdn-cgi/trace from the visitor’s browser. Replace example.com with your website’s domain name.

SSL expired or SSL mismatch errors

Symptom

Visitors observe error messages in their browser about SSL expiration or SSL mismatch.

Resolution

If you use a Custom SSL certificate, first verify that it has not expired or upload a replacement SSL certificate.

Contact Cloudflare support and provide the following information:

  • the affected domain name, and
  • a screenshot of the errors you observe.

Related resources

Not finding what you need?

95% of questions can be answered using the search tool. This is the quickest way to get a response.

Powered by Zendesk