How to Fix Error 526 Invalid SSL Certificate

Introduction

Error 526 Invalid SSL Certificate is an error that occurs when a website’s SSL certificate is not properly configured. This error can prevent users from accessing the website, and can be a major inconvenience. Fortunately, there are a few steps you can take to fix this error. In this article, we will discuss how to troubleshoot and fix Error 526 Invalid SSL Certificate.

How to Fix Error 526 Invalid SSL Certificate

1. Check the SSL Certificate
The first step to fixing an invalid SSL certificate error is to check the SSL certificate itself. Make sure that the certificate is valid and up-to-date. If the certificate is expired or not valid, you will need to obtain a new one.

2. Check the Domain Name
Another common cause of an invalid SSL certificate error is an incorrect domain name. Make sure that the domain name in the certificate matches the domain name of the website you are trying to access.

3. Check the Date and Time
If the date and time on your computer are incorrect, it can cause an invalid SSL certificate error. Make sure that the date and time are set correctly on your computer.

4. Clear Your Browser Cache
Clearing your browser cache can help to fix an invalid SSL certificate error. To do this, open your browser and go to the settings menu. Then, find the option to clear your cache and cookies.

5. Contact Your Web Host
If none of the above steps have worked, you may need to contact your web host. They may be able to help you troubleshoot the issue and get your website back up and running.
[ad_1]

Introduction

Error 526 is an HTTPS error that happens when the website cannot establish a secure connection, indicating a failed or incomplete SSL handshake. It shows that the SSL certificate on the origin server is invalid, expired, self-signed, not configured correctly, or the certificate was issued by an untrusted Certificate Authority (CA).

In this article, you will learn how to fix the 526 Invalid SSL certificate error.

How to fix Error 526: Invalid SSL certificate.

What Is Error 526?

Error 526 is an SSL certificate error that occurs when Cloudflare cannot verify the SSL certificate presented by the origin server. In case the SSL certificate is invalid, web browsers display a warning message that the website is vulnerable to attacks.

Example of an Error 526.

The 526 HTTP response status code is an unofficial server error specific to Cloudflare.

What Causes Error 526 Invalid SSL Certificate?

Error 526 occurs when the origin server’s SSL certificate fails to establish a secure connection. Common causes of the 526 Cloudflare error are:

  • Full (strict) SSL mode on Cloudflare. The Full (strict) mode of Cloudflare’s SSL/TLS encryption may cause the 526 error. Moreover, the Full (Strict) mode does not allow unsecured data exchange between Cloudflare servers and the origin server.
  • Incorrect SSL certificate installation. If the SSL certificate is not installed correctly, the visitor’s browser fails to recognize it, resulting in error 526.
  • SSL certificate not issued by a trusted CA. If the SSL certificate is not issued by a trusted CA, the visitor’s browser does not recognize it as a valid certificate.
  • Expired SSL certificate. SSL certificates have a validity period. Once it expires, the certificate becomes invalid.
  • Self-signed SSL certificate. Self-signed SSL certificates are not issued by a trusted CA and are not trusted by browsers by default.
  • Domain name mismatch. If the SSL certificate domain name does not match the website’s domain name, the visitor’s browser does not recognize it as valid.
  • SSL/TLS protocol mismatch. If the SSL/TLS protocol used by the website does not match the protocol supported by the visitor’s browser, the site visitor gets the 526 invalid certificate error.

How To Fix Cloudflare Error 526 Invalid SSL Certificate?

Depending on the root cause of the issue, there are half a dozen ways to fix Cloudflare’s error 526. The following sections outline how to identify what’s causing the issue and how to fix it.

Method 1: Switch SSL Mode from Full (strict) to Full

Cloudflare offers four SSL modes: Off, Flexible, Full, and Full (Strict). In Full (strict) mode, Cloudflare requires a valid SSL certificate on the origin server. It also verifies the certificate’s hostname against the hostname the browser connects to. In case of any mismatch, Cloudflare returns HTTP status 526 to the browser.

The first thing to do is change the SSL mode from Full (strict) to Full. The Full mode requires an SSL certificate on the origin server, but it does not perform hostname verification.

Follow the steps below to change Cloudflare’s SSL mode from Full (strict) to Full:

1. Log in to your Cloudflare account.

2. Select the domain to change the SSL mode.

3. Navigate to the SSL/TLS tab.

Selecting the SSL/TLS tab in CloudFlare.

4. Under the Overview tab, look for the Encryption settings.

Viewing Encryption settings in CloudFlare.

5. If the Full (strict) mode is selected, change it to Full.

Changing the Full (strict) encryption mode to Full.

After switching the SSL mode to Full, wait a few minutes and try accessing the website again. If the error persists, try the other methods listed below.

Method 2: Check the SSL Certificate

When an SSL certificate is not installed correctly, it results in a 526 error. Check the SSL certificate installation status by logging into your web hosting account or server. Depending on the hosting provider and the type of hosting plan, access the account following one of these methods:

  • Access the account using a web-based control panel like cPanel, DirectAdmin, Webmin, or Plesk.
  • Use a remote desktop application like PuTTY, Remote Desktop Connection (for Windows), or VNC Viewer to connect to the server if you have a VPS or dedicated server.

Once logged in, take the following steps to verify the SSL certificate:

1. Locate the SSL/TLS settings in the web hosting control panel or server configuration settings. Look for an option that says SSL/TLS or Security. For instance, cPanel SSL/TLS settings look like this:

Accessing SSL/TLS settings in cPanel.

2. If the installation status is incomplete or shows errors, reinstall the certificate. The steps vary depending on the provider, but the certificate installation options are often in the same SSL/TLS panel.

Method 3: Check for a Domain Name Mismatch

A possible cause of the Cloudflare 526 error is an SSL certificate that was issued for the wrong or misspelled domain name. Log into your web hosting account or server and check the domain name associated with the SSL certificate.

1. Locate the SSL/TLS settings.

2. Check the domain name on the SSL certificate by looking for an option that displays the SSL certificate’s information.

3. Verify that the domain name on the certificate matches the website’s domain name.

Note: Steps vary depending on the hosting provider.

4. If the domain name is incorrect, contact the SSL certificate provider to fix it.

Method 4: Use a Trusted SSL Certificate

Purchase SSL certificates issued by a trusted Certificate Authority (CA) to ensure most visitors’ browsers recognize the origin server’s certificate.

Note: Using an SSL certificate from a trusted CA prevents errors and assures users that the website is authentic and safe. On the other hand, SSL certificates from untrusted CAs cause issues and are a warning sign to site visitors to leave the page immediately.

Check the list of trusted Certificate Authorities in your local browser’s settings or preferences. For example, in Chrome:

1. Open the Customize and Control Google Chrome drop-down and select Settings > Privacy and security.

Opening Chrome settings.

2. Click Security.

Selecting the Security tab in Chrome settings.

3. Scroll down and click Manage device certificates under the Advanced section:

Choosing the manage device certificates option in Chrome.

If the certificate is on the list, it is trusted by the CA. The process is similar for other browsers.

Another way to check whether the origin server has a certificate from a trusted CA is by using the curl command. For instance, run curl -v on phoenixnap.com:

curl -v https://www.phoenixnap.com
Using the curl command to check a website's certificate.

This command prints SSL certificate details at the bottom, such as the expiration date, domain name, and issuer. The output ends with the note: SSL certificate verify ok.

Alternatively, use curl -I:

curl -I https://www.phoenixnap.com
Using curl -l to check a website's certificate.

The output is extensive, and no error warnings indicate that it is a self-signed certificate. Moreover, the Strict-Transport-Security header indicates that the website uses HTTPS with HSTS (HTTP Strict Transport Security). This header only works on a server that uses a valid SSL certificate issued by a trusted CA.

However, when curl -v is used to check a domain with an untrusted certificate, the commands print error messages. For example:

curl -v https://untrusted-cert-example.com
Example of an untrusted certificate in curl output.

When the origins server’s certificate is not trusted, curl -v prints a warning message along with other data. The output states the specific reason the certificate is not trusted. In this example, the error message states that the SSL certificate problem exists because curl is unable to get the local issuer certificate. The certificate is considered invalid and leads to error 526.

The curl -I command gives a similar output for the same domain:

curl -I https://untrusted-cert-example.com
Example of an invalid certificate.

Note: Both curl -v and curl -I print the SSL certificate details useful for dealing with a 526 error. The difference is that curl -v provides more verbose output explaining the error, while curl -I only displays the error code without additional details.

If your domain’s SSL certificate was no issued by a trusted CA, follow the steps below to fix the issue:

1. Purchase an SSL certificate from a trusted CA, via a reputable web hosting provider or third-party vendor. While more expensive, these certificates provide greater security and are recognized by all major browsers.

2. Install the certificate on the website.

3. Reuse the curl -v command to verify the certificate is trusted.

Method 5: Renew SSL Certificate if Expired

A 526 error on the website sometimes indicates that the SSL certificate has expired. To check whether that is the case, run curl. For instance, verify whether the following website has an expired certificate with curl -I (curl -v also works):

curl -I https://expired-cert-example.com
Checking for an expired website certificate using curl.

If the output shows that the certificate has expired:

1. Renew the SSL certificate based on the instructions on the certificate provider’s website.

2. Install the certificate on the website. The specific steps to do this vary depending on the hosting provider and server setup.

3. Run curl -I or curl -v to verify the renewed SSL certificate is installed correctly.

Note: Some hosting providers offer automatic renewal and installation of SSL certificates.

Method 6: Avoid Self-Signed SSL Certificates

Most web browsers do not trust self-signed SSL certificates. A self-signed SSL certificate is signed by the same entity that issued it instead of being signed by a trusted third-party Certificate Authority (CA).

When a visitor tries to access a website with a self-signed certificate, the browser shows a warning message indicating that the website is not secure.

Error when accessing a website with a self-signed certificate.

Certain browsers even prevent visitors from accessing the website altogether. In certain cases, self-signed certificates cause SSL handshake errors and other SSL-related issues, which leads to Cloudflare’s error 526.

To check whether the origin server uses a self-signed certificate, run curl with the -v argument:

curl -v https://www.bad-cert-example.com
Self-signed certificate error in curl command output.

The output prints a message indicating that the certificate is self-signed. Alternatively, run curl -I to get the error message without the details:

curl -I https://www.bad-cert-example.com
Running curl -l to shorten the output.

To resolve the issue, the site owner must obtain and install an SSL certificate from a trusted CA.

3. Use curl -v to verify the certificate is trusted.

Method 7: Check SSL/TLS Protocol

When a visitor tries to access a website, the browser and the website’s server communicate using a specific SSL/TLS protocol. However, if the SSL/TLS protocol used by the website does not match the protocol supported by the visitor’s browser, error 526 occurs.

To check the SSL/TLS protocol used by the website and ensure it matches the protocol supported by the visitor’s browser, follow these steps:

1. Log in to your web hosting account or server.

2. Navigate to the SSL/TLS settings section. The location of this section depends on the hosting provider and the type of hosting plan.

3. Check the SSL/TLS protocol used by the website.

4. Check the protocol supported by the visitor’s browser. For example, look up the protocol supported by a particular browser online or by review the browser documentation.

5. If the protocols do not match, update the SSL/TLS protocol to one supported by the visitor’s browser.

Save the changes and verify if error 526 has been resolved by recessing the website.

Conclusion

After reading this article, you now know how to fix Cloudflare’s error 526. If you are experiencing other issues with Cloudflare, check our articles on how to fix various Cloudflare errors.

[ad_2]

How to Fix Error 526 Invalid SSL Certificate

Error 526 Invalid SSL Certificate is an error that occurs when a website’s SSL certificate is not valid. This error can be caused by a variety of issues, including an expired certificate, an incorrect domain name, or an incorrect configuration of the server. Fortunately, there are a few steps you can take to fix this error and get your website back up and running.

Step 1: Check the SSL Certificate

The first step in fixing Error 526 Invalid SSL Certificate is to check the SSL certificate. Make sure that the certificate is valid and up-to-date. If the certificate has expired, you will need to renew it. You can do this by contacting your hosting provider or the company that issued the certificate.

Step 2: Check the Domain Name

The next step is to check the domain name. Make sure that the domain name is correct and that it matches the SSL certificate. If the domain name is incorrect, you will need to update it in your hosting provider’s control panel.

Step 3: Check the Server Configuration

The last step is to check the server configuration. Make sure that the server is configured correctly and that the SSL certificate is installed correctly. If the configuration is incorrect, you will need to update it in your hosting provider’s control panel.

Conclusion

Error 526 Invalid SSL Certificate can be a frustrating error to deal with, but it can be fixed with a few simple steps. Make sure to check the SSL certificate, the domain name, and the server configuration to ensure that everything is correct. Once you have done this, your website should be back up and running.

Jaspreet Singh Ghuman

Jaspreet Singh Ghuman

Jassweb.com/

Passionate Professional Blogger, Freelancer, WordPress Enthusiast, Digital Marketer, Web Developer, Server Operator, Networking Expert. Empowering online presence with diverse skills.

jassweb logo

Jassweb always keeps its services up-to-date with the latest trends in the market, providing its customers all over the world with high-end and easily extensible internet, intranet, and extranet products.

GSTIN is 03EGRPS4248R1ZD.

Contact
Jassweb, Rai Chak, Punjab, India. 143518
Item added to cart.
0 items - 0.00