How to fix SSL after Cloudflare setup
If your site shows browser warnings, redirect loops, or Cloudflare SSL errors after setup, the problem usually comes from a mismatch between Cloudflare, your origin server, and your certificate configuration.
This guide explains how to fix SSL after Cloudflare setup with practical checks that isolate the issue fast.
Why SSL breaks after adding Cloudflare
Cloudflare sits between visitors and your origin server, so HTTPS must work in two places: from the visitor to Cloudflare and from Cloudflare to your server.
If either side is misconfigured, you can see errors such as 526 Invalid SSL certificate, 525 SSL handshake failed, ERR_TOO_MANY_REDIRECTS, or browser warnings about an insecure connection.
The most common causes are:
- Cloudflare SSL mode does not match the certificate installed on the origin.
- The origin certificate is expired, self-signed, or missing the correct hostname.
- DNS records point to the wrong server or bypass Cloudflare unexpectedly.
- WordPress, Apache, Nginx, or a load balancer is forcing redirects incorrectly.
- Mixed content loads images, scripts, or styles over HTTP.
Check your Cloudflare SSL mode first
Cloudflare offers four SSL/TLS modes: Off, Flexible, Full, and Full (strict).
The right setting depends on whether your origin server has a valid certificate.
- Off: No HTTPS between visitors and Cloudflare.
Avoid for public sites.
- Flexible: HTTPS works only between visitors and Cloudflare.
Cloudflare connects to the origin over HTTP.
- Full: Cloudflare connects to the origin over HTTPS, but does not validate the certificate.
- Full (strict): Cloudflare connects over HTTPS and validates the origin certificate.
For most modern sites, Full (strict) is the best option because it protects both connections and verifies the certificate chain.
If your site fails in Full (strict), the origin certificate likely needs attention.
Verify the origin certificate on your server
If Cloudflare can reach your site over HTTPS but still reports a certificate problem, inspect the certificate installed on the origin server.
Make sure it is valid for the domain users visit, including any www or non-www version.
Check these details:
- The certificate is not expired.
- The Common Name or SAN includes the exact hostname.
- The full certificate chain is installed, including intermediate certificates.
- The server presents the correct certificate for the virtual host.
Cloudflare Origin CA certificates are a strong option when the origin is only meant to be accessed through Cloudflare.
They are trusted by Cloudflare, not by browsers directly, which is fine because browsers see Cloudflare’s edge certificate.
Fix Cloudflare 525 and 526 errors
525 SSL handshake failed usually means Cloudflare could not complete a secure connection to the origin.
This often points to a protocol, cipher, or server configuration issue rather than a bad certificate alone.
Common fixes include:
- Enable HTTPS on the origin web server.
- Make sure port 443 is open in the firewall and hosting control panel.
- Confirm the server supports modern TLS versions such as TLS 1.2 or TLS 1.3.
- Check whether the web server is presenting the correct certificate for the requested hostname.
526 Invalid SSL certificate means Cloudflare connected to the origin, but the certificate could not be validated.
Fix this by installing a trusted certificate, renewing an expired one, or switching to a proper Cloudflare Origin CA certificate if appropriate.
Resolve redirect loops caused by Flexible SSL
One of the most common issues after Cloudflare setup is a redirect loop.
This often happens when Cloudflare is set to Flexible, but the origin server forces visitors to HTTPS.
Here is why: Cloudflare receives the request over HTTPS from the browser, then connects to the origin over HTTP.
If your origin redirects all HTTP traffic to HTTPS, Cloudflare receives that redirect and retries, creating an endless loop.
To fix this:
- Change Cloudflare SSL mode from Flexible to Full or Full (strict).
- Install a valid certificate on the origin server.
- Review redirects in .htaccess, Nginx config, WordPress plugins, or a CDN/load balancer.
If you must keep Flexible temporarily, remove server-side HTTPS enforcement until the origin certificate is in place.
Correct mixed content after enabling HTTPS
Even when SSL works, your browser may still show a warning or insecure resource notice if pages load assets over HTTP.
This is known as mixed content and is common after migrating a site behind Cloudflare.
Typical mixed content sources include:
- Hardcoded image URLs in posts or page builders.
- Theme stylesheets or JavaScript files with HTTP links.
- Embedded content from external services.
- Old database entries in WordPress pointing to http://.
Use these fixes:
- Update the site URL in WordPress settings to the HTTPS version.
- Replace hardcoded HTTP links in the database using a safe search-and-replace tool.
- Update asset URLs in the theme, child theme, or custom code.
- Use Cloudflare’s Automatic HTTPS Rewrites carefully, but do not rely on it as the only fix.
Confirm DNS records and proxy settings
Cloudflare only protects records that are proxied through its network, shown by the orange cloud icon.
A DNS record that is set to DNS only may expose the origin directly and bypass the Cloudflare certificate layer.
Review your DNS settings and make sure:
- The A or CNAME record points to the correct origin.
- Proxy status matches your intended setup.
- There are no stale records pointing to an old server.
- AAAA records for IPv6 are valid if enabled.
If you are using a load balancer, reverse proxy, or hosting platform like cPanel, Plesk, or Nginx Proxy Manager, confirm that the upstream configuration still matches the domain shown in Cloudflare.
Check server time, firewall rules, and SNI support
SSL validation can fail for reasons that are easy to overlook.
A server clock that is far off can make a valid certificate appear expired or not yet valid.
Security tools, firewalls, and host-level protections can also block Cloudflare IP ranges or interfere with TLS handshakes.
Look for these issues:
- Incorrect server date and time.
- Firewall rules blocking Cloudflare IP ranges.
- Missing Server Name Indication support on older hosting stacks.
- Legacy TLS configuration that disables required ciphers.
Cloudflare publishes IP ranges, and your hosting provider may need to allow them explicitly.
If you use a managed firewall or Web Application Firewall, check whether it is terminating or rewriting SSL traffic.
Use browser and command-line tests to isolate the problem
If the cause is still unclear, test both the browser-facing and origin-facing parts of the chain.
This can show whether the problem is with Cloudflare, the certificate, or the server.
- Open the site in a private browser window and inspect the certificate details.
- Use curl -I to inspect redirects and response headers.
- Test the origin directly if possible, using the server IP and hostname.
- Review Cloudflare’s SSL/TLS and Events logs for handshake or validation failures.
For WordPress sites, plugins that manage redirects, security headers, or caching can also alter SSL behavior.
Temporarily disable conflicting plugins if you suspect they are rewriting URLs or forcing loops.
What to do on WordPress sites
WordPress is especially prone to SSL problems after Cloudflare setup because the database stores URLs in multiple places.
The site URL and home URL should both use the HTTPS version of your domain once the certificate is working.
After updating the settings, check:
- WordPress Address and Site Address in General Settings.
- Hardcoded HTTP links inside posts, widgets, and menus.
- Image URLs in the media library.
- Redirect plugins, caching plugins, and security plugins.
If your admin area is inaccessible due to redirects, verify that Cloudflare SSL mode and origin HTTPS settings agree before changing anything else.
Final SSL verification checklist
Before you consider the issue resolved, confirm that all parts of the chain are consistent.
A clean SSL setup should work without browser warnings and should load all assets over HTTPS.
- Cloudflare SSL mode is set to Full or Full (strict).
- The origin certificate is valid, installed correctly, and covers the hostname.
- DNS points to the correct server and proxy status is intentional.
- Redirects are not looping between HTTP and HTTPS.
- All page assets load securely without mixed content warnings.
- Firewalls, load balancers, and hosting settings allow TLS connections.
If you follow these checks in order, you can usually identify how to fix SSL after Cloudflare setup without guesswork.
The fastest path is to validate the origin certificate, match the Cloudflare SSL mode to that certificate, and then clean up redirects and mixed content.