Error map
525 Cloudflare Error 525: SSL Handshake Failed
Cloudflare · layer 3, Edge & web server
Centre: this error. First ring: errors it is linked with (12). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (12)
Cloudflare Error 521: Web Server Is Down
Cloudflare couldn’t connect to your origin — the connection was refused.
Cloudflare Error 526: Invalid SSL Certificate
With SSL mode Full (strict), the origin’s certificate is expired, self-signed, or doesn’t match the hostname.
Cloudflare Error 520: Web Server Returned an Unknown Error
Cloudflare connected to your origin, but the origin returned an empty, unknown or invalid response.
ERR_SSL_PROTOCOL_ERROR (This site can't provide a secure connection)
The browser couldn’t negotiate TLS — the server sent an invalid response, often plain HTTP on the HTTPS port.
ERR_TOO_MANY_REDIRECTS with Cloudflare (Flexible SSL redirect loop)
The page redirects to itself forever — classic cause: Cloudflare SSL mode “Flexible” while the origin redirects HTTP to HTTPS.
HTTP 421 Misdirected Request
The request reached a server that isn’t configured for that host name — usually HTTP/2 connection reuse across domains sharing a…
SSL: CERTIFICATE_VERIFY_FAILED / unable to get local issuer certificate
The client couldn’t verify the server’s TLS certificate chain, so it refused the HTTPS connection.
400 Bad Request: The plain HTTP request was sent to HTTPS port (Nginx 497)
Plain http:// traffic arrived on a port Nginx expects to be TLS (443 or a custom SSL port).
ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain)
Cloudflare has no edge certificate for the hostname — the Universal SSL cert is still pending, or the hostname is a second-level…
Chrome: This site can’t be reached — example.com unexpectedly closed the connection. ERR_CONNECTION_CLOSED
The server closed the connection before finishing the TLS handshake or sending a response — typical for HTTP/HTTPS port mix-ups,…
Chrome: Your connection is not private — NET::ERR_CERT_REVOKED (the certificate was revoked)
The site’s TLS certificate has been revoked by the certificate authority, so browsers refuse to trust it.
Chrome: Connection not secure — ERR_SSL_OBSOLETE_VERSION (old TLS 1.0/1.1)
The server only supports an outdated TLS version that current browsers no longer allow.
Two steps away (36)
HTTP 502 Bad Gateway
A proxy or gateway (Nginx, load balancer, CDN) got an invalid response — or no response — from the upstream server behind it.
Cloudflare Error 522: Connection Timed Out
Cloudflare’s TCP connection to your origin timed out — the origin didn’t answer at all.
java.net.ConnectException: Connection refused
Nothing is listening at the host:port the Java client connected to.
NET::ERR_CERT_DATE_INVALID (certificate expired)
The site’s certificate has expired (or isn’t valid yet) — or the device clock is wrong.
NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied)
Cloudflare Origin CA certificates are only trusted by Cloudflare — visitors reaching the origin directly (grey-cloud record, dire…
Provisioning profile "x" doesn't include signing certificate "Apple Development: Name (ID)"
The profile was created with a different certificate than the one installed in your keychain.
HTTP 500 Internal Server Error
The server hit an unexpected condition — usually an unhandled exception or misconfiguration in the application.
HTTP 301 Moved Permanently
The resource has a new permanent URL; clients and search engines should use the address in the Location header from now on.
Cloudflare Error 1020: Access Denied
A Cloudflare firewall/WAF custom rule blocked the request — the visitor’s IP, country, user agent or request pattern matched a bl…
javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target
Java doesn’t trust the server’s certificate chain (self-signed, corporate proxy CA, or missing intermediate).
QuotaExceededError: Failed to execute 'setItem' on 'Storage': Setting the value exceeded the quota
localStorage/sessionStorage is full (about 5 MB per origin) or storage is disabled.
NotAllowedError: play() failed because the user didn't interact with the document first.
The browser blocked media autoplay with sound until the user interacts with the page.
HTTP 302 Found (Temporary Redirect)
The resource is temporarily at another URL; clients should keep using the original URL for future requests.
HTTP 303 See Other
A redirect telling the client to fetch the result from another URL with GET — used after a form POST so refreshing doesn’t resubm…
HTTP 307 Temporary Redirect
A temporary redirect that keeps the original method and body — a POST stays a POST at the new URL.
HTTP 400 Bad Request
The server could not understand the request because its syntax, headers or body are malformed or invalid.
Mixed Content: The page was loaded over HTTPS, but requested an insecure resource
An HTTPS page tried to load a script, API or image over plain HTTP, and the browser blocked (or warned about) it.
CLEARTEXT communication to host not permitted by network security policy
Android 9+ blocks plain `http://` requests by default; the app tried to call a non-HTTPS URL.
TypeError: Failed to fetch / NetworkError when attempting to fetch resource
The browser couldn’t complete the request at the network level — CORS, DNS, offline, blocked mixed content, or the server refused…
App Transport Security has blocked a cleartext HTTP resource load
iOS blocked an `http://` request (or a weak-TLS HTTPS one) because App Transport Security requires secure connections.
fatal: Authentication failed for 'https://github.com/x/y.git/'
HTTPS authentication to the Git host failed — wrong or expired credentials, or a password used where a token is required.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
FastCGI sent in stderr: "Primary script unknown"
Nginx passed a script path to PHP-FPM that PHP-FPM couldn’t find — usually a wrong SCRIPT_FILENAME or root.
Nginx 444 No Response (connection closed without response)
An Nginx-specific code: the server deliberately closed the connection without sending anything — a rule is dropping the request.
fatal: unable to access 'https://…': SSL certificate problem: unable to get local issuer certificate
Git doesn’t trust the HTTPS server’s certificate — corporate proxy, self-hosted Git with an internal CA, or outdated CA bundle.
NET::ERR_CERT_AUTHORITY_INVALID (Your connection is not private)
The site’s certificate isn’t signed by a CA the browser trusts — self-signed, missing intermediates, or intercepted by a proxy.
Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames
The server’s certificate doesn’t cover the hostname you connected to.
ERR_CONNECTION_RESET: This site can’t be reached — The connection was reset
The connection to the website was cut off mid-way — by the server, a firewall/antivirus, a VPN/proxy, or network equipment.
Chrome: Your connection was interrupted — A network change was detected. ERR_NETWORK_CHANGED
The device switched networks (Wi-Fi to mobile data, VPN on/off, IP renewed) while the page was loading, so the browser aborted th…
Chrome: This page isn’t working — example.com didn’t send any data. ERR_EMPTY_RESPONSE
The server accepted the connection but closed it without sending any HTTP response — a crash, timeout or misconfigured proxy on t…
Let’s Encrypt / Certbot: Challenge failed for domain example.com — Invalid response from http://example.com/.well-known/acme-challenge/x: 404
Let’s Encrypt couldn’t verify you control the domain — the HTTP-01 challenge file wasn’t served, or DNS points elsewhere.
NET::ERR_CERT_COMMON_NAME_INVALID: Your connection is not private (certificate is for a different domain)
The certificate presented doesn’t include the hostname you visited — e.g. visiting www.example.com with a certificate only for ex…
OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch)
OpenSSL (or Nginx/Apache) couldn’t read the certificate or key — wrong file format, wrong file, or the key doesn’t match the cert…
SSL error: tlsv1 alert protocol version / unsupported protocol / no protocols available
The client and server couldn’t agree on a TLS version or cipher, so the HTTPS handshake failed before any HTTP was exchanged.
Chrome: This site can’t provide a secure connection — uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH
The browser and the server could not agree on a TLS version or cipher — the server is too old or misconfigured, or the browser is.
Chrome: You cannot visit example.com right now because the website uses HSTS (NET::ERR_CERT_… no bypass)
The site told browsers to use only valid HTTPS (HSTS), so Chrome hides the "Proceed anyway" link when its certificate has any pro…
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException