How can I rectify Error 525 SSL handshake failure

[Abaa]

Since my company's website migrated to Cloudflare, we have been having an Error 525 SSL Handshake failure.

We have contacted Cloudflare and they insist it is coming from the origin server and could only be rectified from our end. We have also tried from our end. Please we need help with this from the Godaddy Technical team.

It is so frustrating that Godaddy doesn't have a support email or live chat, so frustrating. As big as the company is, this is a gross let down.

[PL281]

@Abaa 

what is your domain so we can see as end users

[Abaa]

It is abaaexpress.com but note that we only get this error once in a while when trying to visit it but when trying to log into the cpanel and webmail, we get the the error 525 a lot.

[PL281]

@Abaa 

I believe the issue - since you mention that it is when you try going to cPanel & Webmail - is that it has to do with the caching engine with cPanel - 

I would recommend disabling (bypass) the cache and see if that resolves the issue - or setup something like mail.abaaexpress.com  or cpanel.abaaexpress.com which bypasses the cache and setup an SSL from Let's Encrypt which should resolve the issue.

[Abaa]

Wow, I never thought of that! I will try your suggestion and revert back. Hope this works! keeping my fingers crossed.

[dc352 · Accepted solution]

The issue is due to the SSL configuration on your server that probably has invalid SSL - it can be expired certificate, or other misconfiguration. 

Error 525 is a generic error from Cloudflare and if you want to get more information, you either  have to disable CloudFlare for a moment so you can test SSL directly against your servers. Or try one of online audit service that allow testing against a particular IP address (so you can bypass CloudFlare caching). Or inspect your webserver logs if you can spot any issues there.

A quick fix can be also to change your SSL/TLS CloudFlare configuration. The "Flexible" option allows you to disable HTTPS on your servers - CloudFlare will provide the HTTPS between itself and your website visitors.

Dan

———

I've worked around (not only) SSL security for over 20 years in enterprises and startups. 

I am now running an HTTPS expiry management service KeyChest.net

[Abaa]

Thank You Dan for your help.

The server doesn't give any error when cloudflare is deactivated. It has been tested before. I think i will follow your suggestion and switch the SSL/TLS configuration to Flexible and see how it helps. 

Abaa