Can't fix SSL Handshake Failure 525

When I Set my SSL/TlS to the full website doesn't load

It seems that Cloudflare Edge CDN servers can't make a SSL Handshake with my server or takes a lot to time

( I must refresh the page 10 times as fast as possible to get the page to load)

The error is 525 and every guide I read wasn't helping me

I tried pausing cloudflare then renewing my origin server ssl

And then activating Cloudflare

Didn't work

I tried Cloudflare origin server certificate and configured and installed it on my origin server

Didn't work, still a handshake error

My cert is valid on my origin server, when I pause cloudflare i can see my let's encrypt certificate well and up ( it's set up using AutoSSl)

The problem seems to be with Cloudflare edge can't making a connection to my host

Oh and my server is Cpanel based and the default ssl cert is from Let's encrypt

Please help and guide me if you can, it is appreciated

MikeOP•1/19/24, 12:06 AM

no one? sad desperate noises

Cyb3r-Jak3•1/19/24, 12:26 AM

Have you looked at https://developers.cloudflare.com/support/troubleshooting/cloudflare-errors/troubleshooting-cloudflare-5xx-errors/#error-525-ssl-handshake-failed ?

Troubleshooting Cloudflare 5XX errors · Cloudflare Support docs

When troubleshooting most 5XX errors, the correct course of action is to first contact your hosting provider or site administrator to troubleshoot and …

MikeOP•1/19/24, 12:27 AM

this is my website enabled full ssl on cloud dash genshinclub.ir you guys can see you get ssl handshake failure - everything the docs is checke ( sni and cipher suite ) and yes i did

CCyb3r-Jak3 Have you looked at https://developers.cloudflare.com/support/troubleshooting/clo...

MikeOP•1/19/24, 12:27 AM

yes

Cyb3r-Jak3•1/19/24, 12:28 AM

Are there any logs on the server to show a failed handshake?

CCyb3r-Jak3 Are there any logs on the server to show a failed handshake?

MikeOP•1/19/24, 12:29 AM

its a cpanel based host - i actually dont know how to accesss it can you help or guide?

Cyb3r-Jak3•1/19/24, 12:31 AM

I've never used cPanel so not sure either

Cyb3r-Jak3•1/19/24, 12:32 AM

Can you unproxy your site so I can see the certificate on the host

MikeOP•1/19/24, 12:32 AM

I mean I have this

On my mobile this is the client certificate

And I get this error

On my PC browser the certificate is cached with the one on the origin server for now and I don't get the error

Screenshot_20240119_040032_com.android.chrome.jpg

Screenshot_20240119_040026_com.android.chrome.jpg

CCyb3r-Jak3 Can you unproxy your site so I can see the certificate on the host

MikeOP•1/19/24, 12:33 AM

Yeah sure

CCyb3r-Jak3 Can you unproxy your site so I can see the certificate on the host

MikeOP•1/19/24, 12:35 AM

done

cloudflare is paused and you can see the host certificate

Erisa•1/19/24, 12:38 AM

Is Authenticated Origin Pulls enabled? If so, can you try disabling it?

EErisa Is Authenticated Origin Pulls enabled? If so, can you try disabling it?

MikeOP•1/19/24, 12:39 AM

It was disabled from the start

Erisa•1/19/24, 12:39 AM

Makes sense, just was one idea since that can cause handshake issues if the origin is not expecting it

MikeOP•1/19/24, 12:41 AM

I actually tried to delete my host default certificate
And install the Cloudflare origin certificate thinking maybe Let's encrypt is the issue
Didn't help
It became so worse I had to load backup on the host

MikeOP•1/19/24, 12:45 AM

the only solution is to set the ssl to flexible

but that wouldn't be solution it would be ignoring the problem

Erisa•1/19/24, 12:46 AM

Is TLS 1.3 enabled? The origin may not support it

Erisa•1/19/24, 12:47 AM

I did a number of tests against the domain and that was the most I could come up with so far

Cyb3r-Jak3•1/19/24, 12:47 AM

Do you have any firewalling on the server? It seems like some SSL checker tools are unable to reach it but some are

Erisa•1/19/24, 12:48 AM

that too^

EErisa Is TLS 1.3 enabled? The origin may not support it

MikeOP•1/19/24, 12:48 AM

Yes it is enabled

I ran a cipher check and it said the origin is fine with it

I can try to disable it and then check

Erisa•1/19/24, 12:48 AM

Its worth a try but I'd check firewall too as per what @Cyb3r-Jok3 says

Cyb3r-Jak3•1/19/24, 12:49 AM

https://www.ssllabs.com/ssltest/analyze.html?d=genshinclub.ir&hideResults=on
https://dnschecker.org/ssl-certificate-examination.php
https://www.geocerts.com/ssl-checker
All fail but
https://www.immuniweb.com/ssl/genshinclub.ir/tI0HfFF2/
https://mxtoolbox.com/SuperTool.aspx?action=https%3agenshinclub.ir&run=toolpage
https://www.sslchecker.com/sslchecker
all work

MikeOP•1/19/24, 12:49 AM

I see

Let me check

The hosting provider maybe did set a firewall

EErisa Its worth a try but I'd check firewall too as per what @Cyb3r-Jok3 says

MikeOP•1/19/24, 1:08 AM

in response to this - i disabled tls 1.3 and set the minimum tls to 1.0 problem still persisted

Erisa•1/19/24, 1:10 AM

I see

CCyb3r-Jak3 https://www.ssllabs.com/ssltest/analyze.html?d=genshinclub.ir&hideResults=on htt...

MikeOP•1/19/24, 1:10 AM

in response to this i think it was a problem with caching? since Qualys is working fine for me after disabling the proxy

CCyb3r-Jak3 https://www.ssllabs.com/ssltest/analyze.html?d=genshinclub.ir&hideResults=on htt...

MikeOP•1/19/24, 1:13 AM

i tried all of the above and all of them are showing my host certificate

MikeOP•1/19/24, 1:14 AM

it was probably a network bug after pausing cloudflare

MikeOP•1/19/24, 1:15 AM

im kinda thinking about giving up after trying to fix this for 12 hours

EErisa I see

MikeOP•1/19/24, 1:18 AM

do you think the Flexible mode is safe enough to hide my data from Government monitoring system like iran and china? ( i know it came out of blue but a genuine question )

Erisa•1/19/24, 1:19 AM

Flexible mode will encrypt data between your visitors and Cloudflare, but all data between Cloudflare and your origin server will be sent in plain text over the public internet. So probably not.

EErisa Flexible mode will encrypt data between your visitors and Cloudflare, but all da...

MikeOP•1/19/24, 1:22 AM

my only problem is the iranian goverment since cloudflare has no datacenter in iran and my origin server is located in germany do you think they might have a way to access the data between cloudflare and hetzner?

Erisa•1/19/24, 1:23 AM

I couldn't tell you that, I can only tell you what Flexible mode does

EErisa I couldn't tell you that, I can only tell you what Flexible mode does

MikeOP•1/19/24, 1:25 AM

i see - do you know anyone who might have a good idea or its just the comunity ToS to not talk about it

MMike i see - do you know anyone who might have a good idea or its just the comunity T...

MikeOP•1/19/24, 1:28 AM

im new here so i might have missed noticing some rules

Erisa•1/19/24, 1:32 AM

Its not a rule thing, I just don't have an accurate answer and if I did then it wouldn't be appropriate for me to give that kind of advice as an employee. Maybe someone else in the community might have more of an idea.

EErisa Its not a rule thing, I just don't have an accurate answer and if I did then it ...

MikeOP•1/19/24, 1:33 AM

thanks for the help and the time you spent - i think i should make a different post about it - thank you too @Cyb3r-Jok3

Can't fix SSL Handshake Failure 525

Similar Threads

Similar Threads

Similar Threads