| Previous | Next |
| HTTP_STATUS_HANDSHAKE_FAILED | HTTP_STATUS_RAILGUN_ERROR |
HTTP_STATUS_INVALID_CERTIFICATE
Cloudflare documents 526 when Full (strict) mode is enabled and the origin certificate cannot be validated. The certificate can be expired, mismatched, missing an intermediate, or otherwise unsuitable for the origin hostname.
Inspect the certificate chain served by the origin for the requested SNI name, including every backend node. Fix the certificate or hostname configuration rather than lowering verification merely to suppress the error.
Operational meaning of HTTP 526 for HTTP_STATUS_INVALID_CERTIFICATE
HTTP 526 (HTTP_STATUS_INVALID_CERTIFICATE) is a server-error response. AllStat records its meaning as “526 Invalid SSL Certificate”. For HTTP_STATUS_INVALID_CERTIFICATE, interpret it with the request method, selected representation, response headers, and the specification or product that defines the code; the number alone does not prove that application work completed.
Client and server handling for HTTP_STATUS_INVALID_CERTIFICATE
- Correlate HTTP_STATUS_INVALID_CERTIFICATE with origin, gateway, load-balancer, and dependency logs to locate which hop generated it.
- For HTTP_STATUS_INVALID_CERTIFICATE, record request and trace identifiers, upstream timing, retry count, and the health of the selected backend.
- For HTTP_STATUS_INVALID_CERTIFICATE, use bounded retries with backoff only for idempotent work and only when the service policy permits them.
For telemetry, record HTTP 526, method, authority, route template rather than secrets, response headers relevant to caching or retry, latency, upstream identity, and whether the response originated at the application or an intermediary.
Looking for a different code? Search another status or error code.