Why Your SSL Checker Says Everything Is Fine
When a site is proxied by Cloudflare, its hostname resolves to Cloudflare. Every SSL checker, uptime monitor and browser connects there and sees Cloudflare's edge certificate, which Cloudflare renews for you. It stays green.
Behind it is your origin certificate, the one on your own server. Cloudflare connects to it on every request. In Full (strict) mode, the moment it expires or stops matching, visitors get Error 526, even though every checker still says your SSL is fine.
How This Checker Gets Behind Cloudflare
Instead of looking up your hostname, it connects straight to the origin IP you give it on port 443 and sends your hostname in the TLS handshake (SNI), exactly the way Cloudflare does. Your server answers with the certificate it would give Cloudflare. We read it, close the connection, and show you:
- Expiry date and days left on the origin certificate itself.
- Issuer, including whether it's a Cloudflare Origin CA certificate.
- Hostname match against the name you entered.
- Chain trust: self-signed, missing intermediate, or properly signed.
- The verdict: would Full (strict) accept it, or serve Error 526.
It works with Authenticated Origin Pulls, because a server presents its certificate before it asks for Cloudflare's client certificate. We never send an HTTP request and never see your site's content.
Do It Yourself From a Terminal
Same check, from any machine with OpenSSL. Swap in your origin IP and hostname:
openssl s_client -connect 203.0.113.10:443 -servername www.example.com </dev/null 2>/dev/null \
| openssl x509 -noout -subject -issuer -dates -ext subjectAltNameThe -servername part matters. Without it, many servers hand back a default certificate for a different site, and you'll be debugging the wrong cert.
Why Origin Certs Expire Unnoticed
Let's Encrypt renewals on the origin fail quietly all the time: a stopped timer, an HTTP challenge blocked by a Cloudflare setting, a full disk. Let's Encrypt stopped sending expiry reminder emails in 2025, and public certificates are now capped at 200 days and heading to 47. Nobody looks at the origin until Cloudflare starts serving 526s.
Origin Certificate FAQ
Why does every SSL checker say my certificate is fine when Cloudflare shows Error 526?
Because they look up your hostname, which resolves to Cloudflare, so they read Cloudflare's edge certificate. Cloudflare renews that one automatically. Error 526 is about the certificate on your own server, which they never see. This checker connects to your origin IP directly.
Where do I find my origin server's IP?
In the Cloudflare dashboard under DNS, the proxied (orange cloud) A record for the hostname holds your origin IP. Your hosting provider's control panel shows it too. Don't use the address you get from ping or nslookup; that's Cloudflare's edge.
My origin only accepts Cloudflare's IPs. Can you still check it?
Only if the firewall lets us connect. If it allows Cloudflare's ranges only, the check times out. DomainCat monitoring can check an origin like that once you allowlist our prober's IP on port 443. Cloudflare Tunnel origins have no public IP and can't be checked from outside.
Is a Cloudflare Origin CA certificate OK?
Yes, for traffic through Cloudflare. Origin CA certificates are trusted by Cloudflare and accepted in Full (strict) mode, but browsers don't trust them, so never point visitors at the origin directly. They're issued for up to 15 years, so they rarely expire, but they do expire.
What does Full (strict) require from the origin certificate?
Not expired, issued by a publicly trusted CA or Cloudflare Origin CA (not self-signed), covering the hostname, and served with its full chain. If any of these fail, visitors get Error 526.
Do you store the IP I enter?
No. The check runs once and the result is shown to you. Nothing is saved unless you sign up and add the domain for monitoring.