What Cloudflare Is Checking
In Full (strict) mode, Cloudflare validates your origin certificate on every connection. Cloudflare's guide lists what it has to pass:
- Not expired and not revoked
- Signed by a certificate authority (or a Cloudflare Origin CA certificate), not self-signed
- The hostname is in the certificate's Common Name or Subject Alternative Name
- The full chain is sent: your certificate plus any intermediate certificates
- The origin accepts connections on port 443
If any one of these fails, visitors get Error 526. In practice the usual culprit is an expired origin certificate, typically a Let's Encrypt cert whose automatic renewal stopped working weeks ago and nobody noticed.
Step 1: Look at the Origin Certificate Directly
Looking up your hostname won't help here. It shows Cloudflare's edge certificate, which is valid. Ask the origin server directly, from any machine, replacing the IP and hostname with yours:
openssl s_client -connect 203.0.113.10:443 -servername www.example.com </dev/null 2>/dev/null \
| openssl x509 -noout -subject -issuer -dates -ext subjectAltNameThat shows who issued the cert, which names it covers, and when it expires (notAfter). If the dates look fine, run just the first line and read Verify return code near the end: anything other than 0 (ok) points to the chain or the hostname. Cloudflare's guide also suggests temporarily pausing Cloudflare and running the hostname through an SSL checker such as our free domain health check.
Step 2: Fix What You Found
Expired cert. Renew it on the origin (for Let's Encrypt, run your ACME client's renew command, e.g. certbot renew), reload the web server, then find out why automatic renewal failed: a stopped timer, a blocked challenge, a full disk. Otherwise you'll be back here in 90 days.
Hostname not in the cert. Reissue it with every hostname Cloudflare proxies to that server, including www if you use it.
Self-signed cert. Replace it with a Cloudflare Origin CA certificate (free, from SSL/TLS → Origin Server in the dashboard), or add it to Cloudflare's Custom Origin Trust Store.
Missing intermediate. Serve the full chain file (for certbot, fullchain.pem, not cert.pem).
About the "Switch to Full" Quick Fix
Cloudflare lists changing SSL/TLS from Full (strict) to Full as a workaround, and it does bring the site back right away. It works by no longer validating your origin certificate, so the link between Cloudflare and your server stops being verified. Use it to stop the bleeding, fix the cert, then switch back to Full (strict).
Why Nobody Saw It Coming
Most uptime and SSL monitors check your hostname, which means they check Cloudflare's edge certificate. Cloudflare renews that one for you, so it stays green while the origin certificate quietly runs out. The first alert is often a customer seeing Error 526.
Public TLS certificates now last at most 200 days (since March 15, 2026), heading to 47 days by 2029, and Let's Encrypt stopped sending expiry reminder emails in 2025. More renewals and fewer reminders means more chances for one to slip.
Get Warned Before the 526
DomainCat monitors the origin certificate behind Cloudflare separately from the edge cert. Point a domain at your origin server (or import your Cloudflare zones with a read-only token), and it checks the cert your server actually presents, then alerts you at 30, 14 and 7 days by email, Slack, Teams, webhooks or PagerDuty. Free for 5 domains.