# Troubleshooting SSL/TLS

> Fix 525 and 526 errors between the edge and your origin, and edge certificates stuck in Pending or Failed.

## Error 526: invalid origin certificate

Visitors see the page **Invalid origin certificate** with status `526`.

**Cause.** The name is in Full (strict) and the origin's certificate failed verification. Nothing from that origin is served.

**Find the reason.** Open **SSL/TLS › Origin › Origin status** (or run `openwaf-cloud ctl origin-tls status example.com`). The name shows *Would fail with Full (strict) (526)* and the error. Each 526 also produces a rate-limited [security event](https://developers.openwaf.dev/analytics/security-events/) with action `log`, rule `origin_tls` and a short message:

| Message | What to do |
|---|---|
| `origin certificate expired` / `origin certificate not yet valid` | Install a current certificate. Check the server clock for *not yet valid*. |
| `hostname mismatch` | The certificate isn't valid for the [verified name](https://developers.openwaf.dev/ssl/origin-tls/#server-name). Get a certificate for that name, or set `origin.server_name` to a name the certificate covers. |
| `unknown authority` | The certificate is self-signed or from a private CA. Use a public CA or an [OpenWAF Origin CA certificate](https://developers.openwaf.dev/ssl/origin-ca/). |
| `certificate revoked` | The server still serves a revoked Origin CA certificate. Issue and install a new one. |

While you fix it, you can switch the name back to `full` to stop the errors; switch to `full_strict` again once the status is `ok`.

## Error 525: origin TLS handshake failed

Visitors see the page **Origin TLS handshake failed** with status `525`.

**Cause.** The TLS handshake between the edge and your origin failed for a reason other than certificate verification. The event message reads `handshake failed: <alert>`. Common causes:

- **The origin requires a client certificate** and `origin.client_cert` is off, or the change hasn't reached every node yet. The origin status says *The origin asks for a client certificate but the edge doesn't present one.* Turn on [authenticated origin pulls](https://developers.openwaf.dev/ssl/authenticated-origin-pulls/) and wait for propagation, or stop requiring the certificate on the server.
- **Incompatible TLS versions or ciphers.** The origin must accept TLS 1.2 or later.
- **The origin closes the connection**, or the port doesn't speak TLS (`handshake failed: origin did not answer TLS`). Check `origin.scheme` and `origin.port`.

## Certificate pending or failed

In **SSL/TLS › Certificates › Sites**, a name stays in **Pending** or shows **Failed**. **Details** shows the last error, the failed attempts and the next attempt.

| Situation | What to check |
|---|---|
| The zone isn't active yet | Delegated zones: certificates are requested once the delegation to the OpenWAF name servers is detected. Check the delegation in [DNS](https://developers.openwaf.dev/dns/). |
| External zone, name not pointed | HTTP-01 only works once the name points at the edge (`CNAME` to `edge.openwaf.dev`). Check with `openwaf-cloud ctl zones hosts example.com`. |
| `CAA` records | One `CAA` record must allow `letsencrypt.org`. |
| Rate limits of Let's Encrypt | OpenWAF waits and retries on its own; the next attempt is shown. |
| No proxied record | Only proxied `A`, `AAAA` and `CNAME` names get certificates. |

After a failure OpenWAF retries automatically, waiting from 30 minutes up to a day between attempts. You don't need to do anything once the cause is fixed.

A certificate warning such as *renewal overdue* or *certificate expired* on an automatic certificate means renewals have been failing: look at **Details**. On a certificate **Uploaded by an operator**, a warning means it is about to expire and must be replaced; contact support@openwaf.dev.

## The origin status says Unreachable

The check runs from the OpenWAF control plane. If your firewall only admits the edge, the check can't connect even though visitors are served. Use the **Errors (24 h)** column, which comes from the edge, to see real failures.

## HSTS keeps sending browsers to HTTPS

Browsers remember HSTS for the `max-age` they last saw. Setting `hsts.max_age` to `0` stops new visitors, but returning browsers keep using HTTPS until their stored value runs out. See [HSTS](https://developers.openwaf.dev/ssl/hsts/).