Troubleshoot common SSL errors observed when browsing to a domain proxied through Cloudflare.
Overview
Until Cloudflare provides an SSL certificate for your domain, the following errors appear in various browsers for HTTPS traffic:
Firefox
ssl_error_bad_cert_domain
This connection is untrusted
Chrome
Your connection is not private
Safari
Safari can't verify the identity of the website
Edge / Internet Explorer
There is a problem with this website's security certificate
Even with a Cloudflare SSL certificate provisioned for your domain, older browsers display errors about untrusted SSL certificates because they do not support the Server Name Indication (SNI) protocol used by Cloudflare Universal SSL certificates. It is possible for Cloudflare Support to enable non-SNI support for domains on Pro, Business, or Enterprise plans for Universal, Dedicated, Custom, or Custom Hostname certificates.
Otherwise, if SSL errors occur when using a newer browser, review these common SSL error causes:
- Redirect loop errors or HTTP 525 or 526 errors
- Only some of your subdomains return SSL errors
- Your Cloudflare Universal SSL certificate is not active
- OCSP response error
- SSL expired or SSL mismatch errors
Redirect loop errors or HTTP 525 or 526 errors
Symptom
Visitors observe redirect loop errors when browsing to your domain or observe HTTP 525 or 526 errors. These errors occur when the current Cloudflare SSL/TSL encryption mode in the Cloudflare SSL/TLS app is not compatible with your origin web server’s configuration.
Resolution
For redirect loops, refer to our guide on troubleshooting redirect loop errors.
To resolve HTTP 525 or 526 errors, refer to our recommended SSL configurations below. For instance, if your origin web server…
- has either a valid certificate from a Certificate Authority or an Origin CA certificate from Cloudflare, use either the Full or Full (strict) SSL option
- has self-signed SSL certificates, use the Full SSL option
- lacks any installed SSL certificate, utilize the Flexible SSL option.
Only some of your subdomains return SSL errors
Symptom
Cloudflare Universal SSL and regular Dedicated SSL certificates only cover the root-level domain (example.com) and one level of subdomains (*.example.com). If visitors to your domain observe errors accessing a second level of subdomains in their browser (such as dev.www.example.com) but not the first level of subdomains (such as www.example.com), resolve the issue using one of the following methods below.
Resolution
- Ensure the domain is at least on a Business plan and upload a Custom SSL certificate that covers dev.www.example.com, or
- purchase a Dedicated SSL certificate with Custom Hostnames that covers dev.www.example.com, or
- if you have a valid certificate for the second level subdomains at your origin web server, click the orange cloud icon beside the dev.www hostname in the Cloudflare DNS app for example.com.
Your Cloudflare Universal SSL certificate is not active
Symptom
All active Cloudflare domains are provided a Universal SSL certificate. If you observe SSL errors and do not have a certificate of Type Universal within the Edge Certificates tab of the Cloudflare SSL/TLS app for your domain, the Universal SSL certificate has not yet provisioned.
Our SSL vendors verify each SSL certificate request before Cloudflare can issue a certificate for a domain name. This process may take anywhere from 15 minutes to 24 hours. Our SSL certificate vendors sometimes flag a domain name for additional review.
Resolution
If your domain is on a CNAME setup:
Confirm whether you have CAA DNS records enabled at your current hosting provider. If so, ensure you specify the Certificate Authorities that Cloudflare uses to provision certificates for your domain.
If Universal SSL is disabled on your domain under the Disable Universal SSL section of the Edge Certificates tab in Cloudflare SSL/TLS app:
- enable Universal SSL, or
- purchase a Dedicated SSL certificate, or
- upload a Custom SSL certificate to Cloudflare.
If your Cloudflare SSL certificate is not issued within 24 hours of Cloudflare domain activation:
- If your origin web server has a valid SSL certificate, temporarily pause Cloudflare, and
- open a support ticket to provide the following information:
- the affected domain name, and
- a screenshot of the errors you observe.
Temporarily pausing Cloudflare will allow the HTTPS traffic to be served properly from your origin web server while the support team investigates the issue.
OCSP response error
Symptom
Visitors to your site observe an OCSP response error.
Resolution
This error is either caused by the browser version or an issue requiring attention by one of Cloudflare’s SSL vendors. In order to properly diagnose, open a support ticket with the following information provided by the visitor that observes the browser error:
- The output from https://aboutmybrowser.com/
- The output of https://example.com/cdn-cgi/trace from the visitor’s browser. Replace example.com with your website’s domain name.
SSL expired or SSL mismatch errors
Symptom
Visitors observe error messages in their browser about SSL expiration or SSL mismatch.
Resolution
If you use a Custom SSL certificate, first verify that it has not expired or upload a replacement SSL certificate.
Contact Cloudflare support and provide the following information:
- the affected domain name, and
- a screenshot of the errors you observe.