Introduction

Cloudflare Error 526 appears when Full (strict) mode is enabled but the origin certificate fails validation. A very common cause is an incomplete chain on the origin: the leaf certificate is installed, but the intermediate bundle is missing or the server is pointing at the wrong file.

Symptoms

  • Visitors see Cloudflare Error 526 while the origin seems fine when tested loosely
  • The problem appears right after certificate renewal or manual web server changes
  • Direct browser access to the origin may show certificate warnings
  • Cloudflare is set to Full (strict) and the hostname uses a custom certificate at origin

Common Causes

  • The origin server presents only the leaf certificate without the intermediate chain
  • Nginx or Apache points at the wrong certificate file after renewal
  • The certificate does not cover the requested hostname
  • An old certificate bundle remains loaded because the web server was not reloaded

Step-by-Step Fix

  1. 1.Inspect the certificate chain presented by the origin
  2. 2.Check the origin directly, not through Cloudflare, so you can see what the web server is actually serving.
bash
openssl s_client -connect origin.example.com:443 -servername example.com -showcerts
  1. 1.Install the full chain file on the web server
  2. 2.Use the fullchain bundle rather than the leaf certificate alone.
nginx
ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
  1. 1.Reload the server and verify the host name matches
  2. 2.A valid chain still fails in strict mode if the certificate subject does not cover the requested name.
bash
nginx -t && systemctl reload nginx
openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -text -noout | findstr /I "DNS:"
  1. 1.Re-test through Cloudflare after the origin is clean
  2. 2.Once the origin presents a complete chain, Full strict mode should recover without changing Cloudflare to a weaker SSL mode.
bash
curl -I https://example.com

Prevention

  • Always deploy the full chain bundle, not just the leaf certificate
  • Validate the live origin with openssl s_client after renewals
  • Keep Cloudflare in Full strict mode and fix the origin instead of weakening SSL
  • Document which certificate files each web server expects after automation runs