526 is a Cloudflare-specific code. It means Cloudflare could not validate the SSL/TLS certificate of the origin web server while the zone's encryption mode is "Full (strict)". Unlike with 525, the handshake itself worked, but the certificate failed validation.
In "Full (strict)" mode Cloudflare requires an origin certificate that has not expired, is issued for the requested host name (or a matching wildcard) and is signed by a publicly trusted certificate authority or by Cloudflare's own Origin CA.
Example response
HTTP
HTTP/1.1 526 Invalid SSL Certificate
Date: Fri, 06 Nov 2026 10:15:32 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Server: cloudflare
CF-RAY: 8f3a1b2c4d5e6f76-CDGSEO and redirect checking
For crawlers, a 526 is a server error, and the site is unreachable over HTTPS. Renew or replace the origin certificate instead of lowering the SSL mode; a free Cloudflare Origin CA certificate is a common fix.
Common causes and use cases
- The origin certificate has expired, for example because automatic renewal failed.
- The certificate is self-signed or issued for a different host name.
- The certificate chain is incomplete or signed by an untrusted certificate authority.