525 SSL Handshake Failed
Meaning
A Cloudflare-specific status indicating that the SSL/TLS handshake between Cloudflare and the origin server failed. This often means Cloudflare couldn’t establish a secure connection to the origin (certificate issues, protocol mismatch, etc.).
When to Use
When the proxy fails to negotiate an SSL/TLS session with the origin server. Causes can include the origin having an invalid SSL certificate, unsupported protocol versions, or other issues in the handshake process.
Example
Cloudflare will return a 525 SSL Handshake Failed if, for example, the origin server has an expired or self-signed certificate that Cloudflare doesn’t accept, or if the origin only supports ciphers/protocols that are not compatible with Cloudflare’s requirements.
When Not to Use
Do not use in standard server responses. This is reported by proxies. If an origin server experiences handshake issues with a client directly, it wouldn’t send a 525; the connection would just fail. 525 is part of Cloudflare’s error set to inform the client that the proxy-to-origin SSL handshake failed.
Source
Unofficial (Cloudflare)