Cloudflare Docs
SSL/TLS
Cloudflare Docs
SSL/TLS
GitHub icon
Visit SSL/TLS on GitHub
Set theme to dark (⇧+D)
  1. Products
  2. SSL/TLS
  3. Troubleshooting
  4. General SSL errors

General SSL errors

​​ Outdated browsers

​​ Sympton

Until Cloudflare provides an SSL certificate for your domain, the following errors may appear in various browsers for HTTPS traffic:

  • Firefox: _ssl_error_bad_cert_domain / This connection is untrusted
  • Chrome: Your connection is not private
  • Safari: Safari can't verify the identity of the website
  • Edge / Internet Explorer: There is a problem with this website's security certificate

​​ Resolution

Even with a Cloudflare SSL certificate provisioned for your domain, older browsers display errors about untrusted SSL certificates because they do not  support the Server Name Indication (SNI) protocol used by Cloudflare Universal SSL certificates. 

To solve, determine if the browser supports SNI. If not, upgrade your browser.

​​ Only some of your subdomains return SSL errors

​​ Symptom

Cloudflare Universal SSL certificates only cover the apex domain (example.com) and one level of subdomains (blog.example.com). If visitors to your domain observe errors accessing a second level of subdomains in their browser (such as dev.www.example.com) but not the first level of subdomains, resolve the issue using one of the following methods below.

​​ Resolution

  • Purchase an advanced certificate that covers dev.www.example.com.
  • Upload a Custom SSL certificate that covers dev.www.example.com.
  • If you have a valid certificate for the second level subdomains at your origin web server, change the DNS record for dev.www to proxied.

​​ Your Cloudflare Universal SSL certificate is not active

​​ Symptom

All active Cloudflare domains are provided a Universal SSL certificate. If you observe SSL errors and do not have a certificate of Type Universal within the Edge Certificates tab of the Cloudflare SSL/TLS app for your domain, the Universal SSL certificate has not yet provisioned.

Our SSL vendors verify each SSL certificate request before Cloudflare can issue a certificate for a domain name. This process may take anywhere from 15 minutes to 24 hours. Our SSL certificate vendors sometimes flag a domain name for additional review.

​​ Resolution

​​ No Universal certificate

If your Cloudflare SSL certificate is not issued within 24 hours of Cloudflare domain activation:

Temporarily pausing Cloudflare will allow the HTTPS traffic to be served properly from your origin web server while the support team investigates the issue.

​​ Full DNS setup

If your domain is on a full setup, review your DNS records.

Cloudflare SSL/TLS certificates only apply for traffic proxied through Cloudflare. If SSL errors only occur for hostnames not proxied to Cloudflare, proxy those hostnames through Cloudflare.

​​ Partial DNS setup

If your domain is on a partial setup, confirm whether you have CAA DNS records enabled at your current hosting provider. If so, ensure you specify the Certificate Authorities that Cloudflare uses to provision certificates for your domain.

​​ OCSP response error

​​ Symptom

Visitors to your site observe an OCSP response error.

​​ Resolution

This error is either caused by the browser version or an issue requiring attention by one of Cloudflare’s SSL vendors. In order to properly diagnose, contact Support with the following information provided by the visitor that observes the browser error:

  1. The output from https://aboutmybrowser.com/  .
  2. The output of https://<YOUR_DOMAIN>/cdn-cgi/trace from the visitor’s browser.

​​ Incorrect HSTS headers

​​ Symptom

The HSTS headers (Strict-Transport-Security and X-Content-Type-Options) in the response do not match the configuration settings defined in your HSTS settings.

​​ Resolution

You may have configured HTTP Response Header Modification Rules that are overriding the HSTS header values defined in the SSL/TLS app.

  1. Go to Rules > Transform Rules.
  2. Under HTTP Response Header Modification, check the existing rules for a rule that is setting the value of one of the HSTS headers (Strict-Transport-Security or X-Content-Type-Options).
  3. Delete (or edit) the rule so that the HSTS configuration settings defined in the SSL/TLS app are applied.
  4. Repeat this procedure for the other HSTS header.

​​ Kaspersky Antivirus

To avoid SSL errors with the Cloudflare dashboard when using Kaspersky Antivirus, allow dash.cloudflare.com in Kaspersky.