Error 526: invalid origin certificate
Visitors see the page Invalid origin certificate with status 526.
Cause. The name is in Full (strict) and the origin's certificate failed verification. Nothing from that origin is served.
Find the reason. Open SSL/TLS › Origin › Origin status (or run openwaf-cloud ctl origin-tls status example.com). The name shows Would fail with Full (strict) (526) and the error. Each 526 also produces a rate-limited security event with action log, rule origin_tls and a short message:
| Message | What to do |
|---|---|
origin certificate expired / origin certificate not yet valid | Install a current certificate. Check the server clock for not yet valid. |
hostname mismatch | The certificate isn't valid for the verified name. Get a certificate for that name, or set origin.server_name to a name the certificate covers. |
unknown authority | The certificate is self-signed or from a private CA. Use a public CA or an OpenWAF Origin CA certificate. |
certificate revoked | The server still serves a revoked Origin CA certificate. Issue and install a new one. |
While you fix it, you can switch the name back to full to stop the errors; switch to full_strict again once the status is ok.
Error 525: origin TLS handshake failed
Visitors see the page Origin TLS handshake failed with status 525.
Cause. The TLS handshake between the edge and your origin failed for a reason other than certificate verification. The event message reads handshake failed: <alert>. Common causes:
- The origin requires a client certificate and
origin.client_certis off, or the change hasn't reached every node yet. The origin status says The origin asks for a client certificate but the edge doesn't present one. Turn on authenticated origin pulls and wait for propagation, or stop requiring the certificate on the server. - Incompatible TLS versions or ciphers. The origin must accept TLS 1.2 or later.
- The origin closes the connection, or the port doesn't speak TLS (
handshake failed: origin did not answer TLS). Checkorigin.schemeandorigin.port.
Certificate pending or failed
In SSL/TLS › Certificates › Sites, a name stays in Pending or shows Failed. Details shows the last error, the failed attempts and the next attempt.
| Situation | What to check |
|---|---|
| The zone isn't active yet | Delegated zones: certificates are requested once the delegation to the OpenWAF name servers is detected. Check the delegation in DNS. |
| External zone, name not pointed | HTTP-01 only works once the name points at the edge (CNAME to edge.openwaf.dev). Check with openwaf-cloud ctl zones hosts example.com. |
CAA records | One CAA record must allow letsencrypt.org. |
| Rate limits of Let's Encrypt | OpenWAF waits and retries on its own; the next attempt is shown. |
| No proxied record | Only proxied A, AAAA and CNAME names get certificates. |
After a failure OpenWAF retries automatically, waiting from 30 minutes up to a day between attempts. You don't need to do anything once the cause is fixed.
A certificate warning such as renewal overdue or certificate expired on an automatic certificate means renewals have been failing: look at Details. On a certificate Uploaded by an operator, a warning means it is about to expire and must be replaced; contact [email protected].
The origin status says Unreachable
The check runs from the OpenWAF control plane. If your firewall only admits the edge, the check can't connect even though visitors are served. Use the Errors (24 h) column, which comes from the edge, to see real failures.
HSTS keeps sending browsers to HTTPS
Browsers remember HSTS for the max-age they last saw. Setting hsts.max_age to 0 stops new visitors, but returning browsers keep using HTTPS until their stored value runs out. See HSTS.