HTTP 425 Too Early vs 526 Invalid SSL Certificate
HTTP 425 (Too Early) is a 4xx Client Error response, while 526 (Invalid SSL Certificate) is a 5xx Server Error response. 425 indicates that the server is unwilling to risk processing a request that might be replayed. Used with TLS 1.3 early data (0-RTT). In contrast, 526 means that cloudflare-specific. The origin's SSL certificate could not be validated.
Description
The server is unwilling to risk processing a request that might be replayed. Used with TLS 1.3 early data (0-RTT).
When You See It
When a server rejects a request sent as TLS 1.3 early data due to replay risk.
How to Fix
Retry the request after the TLS handshake completes.
Description
Cloudflare-specific. The origin's SSL certificate could not be validated.
When You See It
When using Cloudflare Full (Strict) mode with an invalid origin certificate.
How to Fix
Install a valid SSL certificate on the origin, or use Cloudflare Origin CA certificate.
Key Differences
425 is a 4xx Client Error response, while 526 is a 5xx Server Error response.
HTTP 425: The server is unwilling to risk processing a request that might be replayed. Used with TLS 1.3 early data (0-RTT).
HTTP 526: Cloudflare-specific. The origin's SSL certificate could not be validated.
You encounter 425 when when a server rejects a request sent as TLS 1.3 early data due to replay risk.
You encounter 526 when when using Cloudflare Full (Strict) mode with an invalid origin certificate.
When to Use Which
For 425 (Too Early): Retry the request after the TLS handshake completes. For 526 (Invalid SSL Certificate): Install a valid SSL certificate on the origin, or use Cloudflare Origin CA certificate.