SSL Handshake Failed

Cloudflare-specific. Cloudflare connected to your origin but couldn't complete the TLS handshake with it.

You only get a 525 when Cloudflare's SSL mode is Full or Full (strict), which means Cloudflare talks to your origin over HTTPS. The connection to the origin works, but the two sides can't agree on TLS, so no request is ever sent.

What we see on Larm

Failed HTTP checks on Larm from 9 October to 8 November 2026, across about 130 monitors.

3 monitors got a 525 in this period, 9 failed checks in total. The median time to first byte was 404 ms.

COMMON CAUSES

No valid certificate is installed on the origin

Port 443, or the custom HTTPS port you use, is closed on the origin

The origin doesn't support SNI

The origin's cipher suites don't overlap with the ones Cloudflare supports

HOW TO FIX IT

Check the origin's certificate directly, bypassing Cloudflare: curl -v --resolve example.com:443:<origin-ip> https://example.com/

If there's no certificate, install one. A free Cloudflare Origin CA certificate works for Full (strict)

Make sure the origin is listening on 443

If it only happens sometimes, check the web server's error log at the time of each 525. Nginx logs handshake failures, at a higher log level if needed

What this means for monitoring

A 525 often starts when an origin certificate expires or gets replaced, since visitors only ever see Cloudflare's certificate. A Larm monitor on the origin itself, with its SSL expiry alerts, warns you before the origin certificate runs out.

Related status codes

5xx Server Error

500

Internal Server Error

Something went wrong on the server and it has nothing more specific to say. It's what most frameworks return when your code throws an exception it doesn't handle.

502

Bad Gateway

A server in the middle, like a load balancer, reverse proxy or CDN, tried to pass your request on to the server behind it and got back something it couldn't use. Either the upstream server didn't answer properly, or the connection closed before a full response came back.

503

Service Unavailable

The server is up but can't handle the request right now. It's meant to be temporary: overload, maintenance, or an app that isn't ready yet.

504

Gateway Timeout

A proxy or load balancer forwarded your request and gave up waiting for the server behind it to answer.

520

Web Server Error

Cloudflare-specific. Cloudflare connected to your origin server and got a response it couldn't use, or no response at all.

521

Web Server Down

Cloudflare-specific. Cloudflare tried to connect to your origin server and the connection was refused.

522

Connection Timed Out

Cloudflare-specific. Cloudflare tried to connect to your origin and the connection timed out.

523

Origin Unreachable

Cloudflare-specific. Cloudflare can't find a network route to your origin server.

530

Origin DNS Error or Tunnel Error

Cloudflare-specific. Cloudflare couldn't find where to send the request: it couldn't resolve the origin's hostname, or the Cloudflare Tunnel for it isn't connected.

Get alerted when your endpoints return unexpected status codes.

Larm checks your HTTP endpoints from multiple global locations and alerts you when they return status codes outside your expected range.