Tell Cloudflare 521, 522, 525 and 526 errors apart

Cloudflare's branded error page tells you which stage failed between its network and your website's origin. Four similar-looking codes need different investigations. Restarting everything can erase the timing evidence and leave the actual cause untouched.

1. Save a useful incident record

Capture the error number, affected hostname and path, UTC time and Ray ID from the page. Note whether all visitors see it or whether it is intermittent. Avoid including login cookies or private query parameters in screenshots. Check which origin address and port your Cloudflare configuration intends to use; a DNS record pointing to an old server can imitate a server failure.

2. Choose the right branch

521: the origin refuses the connection. Check that the expected web service is actually listening and that intended Cloudflare traffic is not rejected.
522: Cloudflare times out communicating with the origin. Look for reachability problems, overloaded listeners and firewall drops. A timeout is not evidence of a certificate expiry.
525: the TLS handshake to the origin fails. Review TLS listener configuration and matching handshake errors.
526: Cloudflare cannot validate the origin certificate under strict validation. Check the hostname, validity dates and chain.

3. Collect origin evidence

For a website you manage on a Linux VPS, the following checks read listener state and recent Nginx service logs. Run the equivalent for Apache or your actual web service instead of assuming Nginx is installed.

sudo ss -ltnp '( sport = :80 or sport = :443 )'
sudo systemctl status nginx --no-pager
sudo journalctl -u nginx --since '15 minutes ago' --no-pager

Also review the site's configured access and error logs around the saved timestamp. A healthy service process with no listener on the expected address is still a configuration problem. A quiet access log does not establish that requests reached the host: failures before HTTP may appear only in firewall, TLS or proxy logs.

4. Compare a controlled request

If origin access is permitted from your management machine, test its known address with the intended hostname using curl --resolve. Keep certificate validation enabled. A firewall intentionally allowing only Cloudflare can block this comparison, so interpret a direct timeout within that design rather than weakening it.

For a 526 incident involving Cloudflare Origin CA, use Cloudflare's origin validation requirements. A regular browser does not ordinarily trust that private origin CA. Changing the SSL mode to Flexible can introduce redirect loops and remove the intended protection on the origin connection.

Confirm recovery

After the responsible administrator makes one documented change, repeat the original public request and watch matching logs. Test several new connections for intermittent incidents. Do not flush firewall rules or expose management ports. Escalate with the Ray ID, time, code, origin listener result and redacted log excerpt if you cannot distinguish a network failure from a TLS failure.