The symptom
The origin was configured for HTTPS. Using curl with the right Host header against the origin returned 200. But going through Cloudflare kept returning 526 Invalid SSL Certificate.
First mistake: assuming 526 is a server config problem
I confirmed the origin first: certificate and private key matched, validity period was fine, Nginx config passed syntax check, local test returned 200. All correct. So the problem had to be elsewhere.
Then I looked at the Cloudflare SSL/TLS mode. It was set to Automatic.
What "Automatic" actually does
Most people assume Automatic is a fixed mode that picks something sensible. It is not. Cloudflare dynamically decides what to use and switches between modes depending on what it observes at the origin.
With an origin certificate that is not in the public trust chain (a Cloudflare Origin CA certificate, for example), the dynamic decision ends up attempting full verification — and fails.
Fix
Set SSL/TLS mode to Full (or Full Strict when you have a valid public certificate). The moment I switched it, 526 disappeared.
The architectural lesson
"Automatic" is not the same as "safe". A mode that decides for you hides the state machine that actually determines behaviour. When it works you never learn what it chose; when it fails you have no idea where to look.
Predictable failure beats unpredictable intelligence.
Comments