Diagnosing Cloudflare error 525 during the origin TLS handshake Cloudflare error 525 means its TLS handshake with the origin failed. The browser may already have a valid connection to Cloudflare, so focus on the…

Diagnosing Cloudflare error 526 with Full strict TLS Cloudflare error 526 indicates that the origin certificate cannot be validated for the requested strict TLS connection. Inspect the certificate actually…

Diagnosing a pending Cloudflare edge certificate An edge certificate protects the browser-to-Cloudflare connection. If its status remains pending, investigate domain activation and certificate…

Enabling HSTS only after all required hostnames support HTTPS HSTS tells browsers to require HTTPS for a period of time. Enable it only after HTTPS is reliable, because cached HSTS policy can keep a site…

Finding mixed content when HTTPS works through Cloudflare Mixed content occurs when an HTTPS page requests assets through HTTP. The main certificate can be valid while browsers block scripts, styles, images or…

Fixing a Cloudflare HTTPS redirect loop A redirect loop occurs when Cloudflare and the origin disagree about the expected scheme or hostname. Trace the actual Location responses before…

Installing a Cloudflare Origin CA certificate and understanding its trust Cloudflare Origin CA certificates secure traffic between Cloudflare and a proxied origin. They are not ordinary public-browser certificates, so plan…

Moving a Cloudflare site to Full strict TLS safely Full (strict) encrypts the Cloudflare-to-origin connection and validates the origin certificate. Use it after every relevant origin presents an…