Cloudflare invalid SSL certificate (Error 526) on a custom domain

What it means in plain English

Cloudflare's definition: "Cloudflare is unable to verify the SSL certificate on your origin server." The origin is wherever Cloudflare forwards traffic, such as Vercel, Lovable, or your own server.

Cloudflare says the error appears when two things are both true: Cloudflare "cannot validate the SSL certificate at your origin web server," and Full (strict) is set in the Overview tab of the SSL/TLS app.

Likely causes

Cloudflare lists what it checks on the origin certificate:

• It is expired or revoked.
• It is self-signed instead of "signed by a Certificate Authority."
• The hostname is not in its Common Name or Subject Alternative Name.
• The chain is incomplete. Cloudflare says the origin "must serve the leaf certificate along with any required intermediate CA certificates."
• The origin doesn't accept connections on port 443.

On a hosted platform, the usual reason is that the host has not issued a certificate for the domain yet. Lovable, for example, keeps a domain in Verifying if the A record is proxied during manual setup.

How to fix it, step by step

1. Decide whether you need Cloudflare's proxy at all. Vercel says "We recommend connecting directly where possible" and that you "can keep Cloudflare as your DNS provider without enabling its reverse proxy."
2. To go direct: set the record to DNS only in Cloudflare and follow the host's DNS records. Vercel: "Set the relevant Cloudflare records to DNS only" and "Confirm domain verification and certificate status in Vercel." Lovable's manual setup also needs proxying off on the A record while verification is in progress.
3. Before switching an existing proxied domain to DNS only, Vercel says to "confirm that Vercel presents a publicly trusted certificate for the hostname," because "Cloudflare Origin CA certificates ... browsers may reject them when connecting directly."
4. To keep the proxy: the origin must have a certificate Cloudflare trusts. Vercel says to use Full (strict) "with an origin certificate that meets Cloudflare's validity, trust, and hostname requirements." On a server you run, Cloudflare offers a Cloudflare Origin CA certificate at the origin, or adding a self-signed certificate to its Custom Origin Trust Store.
5. For Lovable in proxy mode, reconnect the domain with Advanced → Uses Cloudflare or similar proxy. Lovable then gives you a CNAME to your lovable.app address and issues the certificates once it points correctly. Lovable says it "does not configure, validate, or monitor your CDN or proxy setup."
6. Don't switch to Flexible to hide the error on Vercel. Vercel says "Flexible mode can cause a redirect loop."
7. Cloudflare also lists setting SSL to Full instead of Full (strict) as "a potential quick fix." It doesn't fix the origin certificate.

How to check it worked

• The domain loads over https with no Cloudflare error page.
• The host's dashboard shows the domain as valid or Live, with an issued certificate.

Questions people ask

What causes Cloudflare Error 526?

Cloudflare says it happens when SSL is set to Full (strict) and Cloudflare cannot validate the SSL certificate on your origin web server.

What does Cloudflare check on the origin certificate?

That it is not expired or revoked, is signed by a certificate authority rather than self-signed, covers the requested hostname, comes with a complete chain, and that the origin accepts connections on port 443.

Should I use Flexible SSL on Cloudflare in front of Vercel?

No. Vercel says Flexible mode can cause a redirect loop, because Cloudflare connects over HTTP and Vercel redirects to HTTPS. Use Full (strict) with a valid origin certificate, or keep Cloudflare as DNS only.

Sources

• https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-526/ (opens in a new tab)
• https://vercel.com/docs/integrations/external-platforms/cloudflare (opens in a new tab)
• https://docs.lovable.dev/features/custom-domain (opens in a new tab)