Separate edge and origin TLS
The certificate a visitor receives belongs to the Cloudflare edge. Cloudflare then creates a separate connection to the origin, governed by the zone's SSL/TLS encryption mode and the origin certificate. A valid edge certificate cannot repair an invalid origin certificate, and the reverse is also true.
Confirm hostname coverage
Check the exact apex, www and application hostnames visitors use. Wildcards cover only their defined level, and a certificate can be active while omitting a newly added hostname. Keep the existing certificate path active until the replacement is issued and served for every required name.
Use Full (strict) safely
Full (strict) is normally the correct origin mode because Cloudflare validates the origin certificate, hostname and trust. Install a publicly trusted or Cloudflare Origin CA certificate at the origin first, include the required hostnames and verify the complete chain before selecting strict validation.
Set protocol policy deliberately
A higher minimum TLS version improves security but can exclude older browsers, devices or integrations. Measure the client population, test critical automated clients and raise the minimum in a controlled window. Cipher customization is an expert control and should retain a modern interoperable set.
Diagnose certificate errors
Identify whether failure occurs before Cloudflare, at the edge certificate, or between Cloudflare and the origin. Check hostname, expiry, chain, origin mode and DNS proxy status. Error 525 indicates an origin TLS handshake failure; error 526 indicates that strict origin certificate validation failed.
Recover safely
Restore the previous origin mode or certificate only long enough to recover service, then fix the underlying hostname, expiry or trust problem. Never leave certificate validation disabled as a permanent workaround. Retest every public hostname after recovery.
