What the check looks at
A5 opens a TLS connection to port 443 on your server itself, not to Cloudflare. It tries 127.0.0.1, then the address the server knows itself by, then the outgoing address of the server when that is not a Cloudflare address. From the certificate it reads the issuer, the names it covers (CN and SAN), the expiry date and whether a public authority vouches for it.
This is the certificate Cloudflare validates when the SSL/TLS mode is Full (strict). Visitors never see it, so an expired or wrong certificate here goes unnoticed until Cloudflare refuses to serve the site.
Results and what they mean
| Result | What it means |
|---|---|
| PassedConfidence: High | The certificate on your server is valid A public authority vouches for the certificate and it has at least 14 days left. |
| PassedConfidence: High | Your server uses a Cloudflare Origin CA certificate Issued by the Cloudflare Origin CA, which is what Full (strict) expects. It is not meant to be trusted by browsers directly. |
| FailedConfidence: High | The certificate on your server has expired With Full (strict) an expired certificate takes the site down with error 526. |
| FailedConfidence: High | The certificate on your server expires within days Fewer than 3 days left. |
| WarningConfidence: High | The certificate on your server expires soon Fewer than 14 days left. Check that whatever renews it is still working. |
| WarningConfidence: High | The certificate on your server is for a different name The certificate does not cover this site name. With Full (strict) that gives error 526. |
| WarningConfidence: Medium | The certificate on your server is not publicly trusted Self-signed, or no public authority vouches for it. That is expected for a Cloudflare Origin CA certificate the plugin did not recognise, and a problem otherwise. Read the issuer in the evidence. |
| Could not checkConfidence: Low | This check could not be completed Port 443 did not answer in time, PHP cannot open TLS connections, or WordPress refuses connections to its own host. See the reasons below. |
| Not applicable | Nothing answers on port 443, so there is no certificate to read Check A2 reports this case. Reason covered_by_other_check. |
| Not applicable | Cloudflare is not in front of this site Check A1 did not detect Cloudflare, so this check sent no request. Reason not_behind_cloudflare. |
When the result names a reason
loopback_failed: Your server could not reach its own site, so this check had nothing to read. The plugin links this result to its own guide: Your server could not reach its own site.blocked_by_config: WordPress itself refused the requests from your site to itself, so none was sent. WP_HTTP_BLOCK_EXTERNAL is on, and your own address is not let through. The plugin links this result to its own guide: WordPress blocks requests to your own site.php_function_unavailable: A PHP function this check needs is turned off on your server. A5 needs the OpenSSL extension andstream_socket_client(). Your host can tell you whether either is turned off.covered_by_other_check: Another check already reports on this. Nothing listens on port 443, which check A2 reports.not_behind_cloudflare: This site is not behind Cloudflare.
Symptoms you may notice
- Visitors suddenly get Cloudflare error 526 (invalid SSL certificate) while the mode is Full (strict), often on the day the certificate expires.
- Error 525 (SSL handshake failed) when nothing valid answers on port 443 in Full or Full (strict).
- Nothing at all in Full mode, which does not validate the certificate. The problem appears only when someone switches to Full (strict).
- No reminder from Cloudflare: it does not send expiry notifications for Origin CA certificates.
Why it happens
In Full (strict), Cloudflare validates the certificate on your server. Error 526 appears when “Cloudflare cannot validate the SSL certificate at your origin web server”: it is expired, revoked, self-signed, does not list the requested name in its Common Name or Subject Alternative Name, or is served without its intermediate certificates (Cloudflare: error 526).
Common causes are a renewal that stopped working, a default certificate of the hosting panel issued for the server name instead of your domain, and a self-signed certificate left from setup.
Confirm it by hand
Connect to your server’s own address while sending your domain name, and read what it presents. Replace the address with your server IP:
curl -svo /dev/null --resolve example.com:443:203.0.113.10 https://example.com/curl prints the subject, the subject alternative names, the expiry date and the issuer. For an Origin CA certificate curl reports that it cannot verify it, which is expected; add -k to read the details anyway. With OpenSSL:
openssl s_client -connect 203.0.113.10:443 -servername example.com </dev/null | openssl x509 -noout -issuer -subject -datesHow to fix it
Renew or replace the certificate on the server. This is done in your hosting panel or on the server, not in WordPress. Two options work with Full (strict):
- a certificate from a public authority, such as Let’s Encrypt, issued for every name the site uses;
- a Cloudflare Origin CA certificate, if the server receives traffic only through proxied records.
If the site is already down with 526: Cloudflare’s own quick fix is to set the mode to Full instead of Full (strict) while you replace the certificate. Full encrypts the connection but does not validate the certificate, so switch back to Full (strict) once the new one is installed.
Cloudflare also lets you add a self-signed certificate to a Custom Origin Trust Store so Full (strict) accepts it; see the error 526 page in the sources.
Limitations
The plugin recognises an Origin CA certificate only when its issuer contains the text Cloudflare Origin. The exact issuer strings are not yet confirmed, so a real Origin CA certificate can land in the Warning with Medium confidence. Read the issuer in the evidence before acting.
The plugin reads what the server presents to a connection from the server itself. Behind a load balancer or a proxy in front of the server, Cloudflare may be given a different certificate.
Error 526 can also come from a revoked certificate or a missing intermediate certificate, which the plugin does not test.
Related checks
- A2 Flexible SSL: whether Cloudflare uses https to your server at all.
- E3 Cloudflare 52x errors: whether 525 or 526 already appeared during the run.
- A1 Cloudflare detection and connection type: how the site is connected to Cloudflare.
Sources
- Cloudflare: error 526
- Cloudflare: error 525
- Cloudflare: Origin CA certificates
- Cloudflare: encryption modes
Run this check on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.
Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.