Troubleshooting SSL Handshake Errors (Error 525 & 526)

Understanding Cloudflare SSL Errors#

When connecting a custom domain through Cloudflare, Error 525 or 526 indicates a mismatch between Cloudflare's edge certificate and Convoia's origin server certificate.

1. Resolving Error 525 (SSL Handshake Failed)#

• Cause: Cloudflare attempted an SSL handshake with the origin server, but the origin did not respond with a valid SSL cipher or port 443 handshake.
• Fix:

1. In Cloudflare, set the CNAME proxy status to DNS only (Grey Cloud) temporarily.

2. Ensure the origin target is set strictly to convoia.academy.

3. Wait 5 minutes, then switch the proxy back to Proxied (Orange Cloud) with SSL mode set to Full.

2. Resolving Error 526 (Invalid SSL Certificate)#

• Cause: Cloudflare is set to Full (Strict), but the origin certificate does not match the custom hostname directly.
• Fix:

1. In Cloudflare SSL/TLS settings, change the mode from Full (Strict) to Full.

2. This allows Cloudflare to trust the origin wildcard certificate while still providing end-to-end HTTPS encryption to your students.