# SSL handshake failed error code 525 **URL:** \ **Category:** Installation\ **Created:** [February 8, 2023, 1:08am UTC](https://forum.ghost.org/t/ssl-handshake-failed-error-code-525/36163 "2023-02-08T01:08:43Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![tobitech](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/tobitech/32/22982_2.png) [@tobitech](https://forum.ghost.org/u/tobitech)\ **Post date:** [February 8, 2023, 1:08am UTC](https://forum.ghost.org/t/ssl-handshake-failed-error-code-525/36163/1 "2023-02-08T01:08:43Z")
I recently installed Ghost on Digital Ocean and I’m using Cloudfare to manage the DNS for this domain [https://theboujeetrybe.com/](https://theboujeetrybe.com/) but I’m having issue with the SSL. Here is the error I keep getting: It appears that the SSL configuration used is not compatible with Cloudflare. This could happen for a several reasons, including no shared cipher suites. ![Screenshot 2023-02-07 at 13.34.09](https://us1.discourse-cdn.com/flex015/uploads/ghost2/original/3X/d/6/d6b52ec5335b973ac36196da0ad1293d724fbcba.jpeg) How can I make the SSL on Ghost blog work with Cloudfare? Sometimes it works without this error and some times this error shows up and it’s annoying for visitors. ---
**Author:** ![mjw](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/mjw/32/30781_2.png) [@mjw](https://forum.ghost.org/u/mjw)\ **Post date:** [February 8, 2023, 9:06pm UTC](https://forum.ghost.org/t/ssl-handshake-failed-error-code-525/36163/2 "2023-02-08T21:06:18Z")
How did you set up Ghost, Nginx and SSL? What are the SSL settings in Cloudflare, e.g., authenticated origin pulls? ---
**Author:** ![tobitech](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/tobitech/32/22982_2.png) [@tobitech](https://forum.ghost.org/u/tobitech)\ **Post date:** [February 9, 2023, 12:42am UTC](https://forum.ghost.org/t/ssl-handshake-failed-error-code-525/36163/3 "2023-02-09T00:42:55Z")
I followed the official guide here - [How to install Ghost on Digital Ocean - Official guide](https://ghost.org/docs/install/digitalocean/) to install Ghost. SSL setting on Cloudfare is Full: Encrypts end-to-end, using a self signed certificate on the server. ![Screenshot 2023-02-09 at 01.41.30](https://us1.discourse-cdn.com/flex015/uploads/ghost2/original/3X/2/f/2f683180ba4d473402462d4a6fb227d876344d81.png) ---
**Author:** ![markstos](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/markstos/32/18182_2.png) [@markstos](https://forum.ghost.org/u/markstos)\ **Post date:** [February 9, 2023, 4:57am UTC](https://forum.ghost.org/t/ssl-handshake-failed-error-code-525/36163/4 "2023-02-09T04:57:29Z")
SSH to the server and check if you can make an https:// request from the server itself. I like the httpie tool for HTTP testing, but you could also use wget or curl. ---
**Author:** ![tobitech](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/tobitech/32/22982_2.png) [@tobitech](https://forum.ghost.org/u/tobitech)\ **Post date:** [February 9, 2023, 11:05am UTC](https://forum.ghost.org/t/ssl-handshake-failed-error-code-525/36163/5 "2023-02-09T11:05:17Z")
Whenever I pause Cloudfare on the domain I start getting “site not secure” error on Safari and Chrome. Running `https https://theboujeetrybe.com` and `https theboujeetrybe.com` with `httpie` returns this header followed by the HTML content of the home page. ```auto HTTP/1.1 200 OK Cache-Control: public, max-age=0 Connection: keep-alive Content-Encoding: gzip Content-Type: text/html; charset=utf-8 Date: Thu, 09 Feb 2023 11:02:22 GMT ETag: W/"28da-XAZAD6KAG4iBMNDnDkZsEHoEq1g" Server: nginx/1.18.0 (Ubuntu) Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Transfer-Encoding: chunked Vary: Accept-Encoding X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Powered-By: Express ``` But site reachability is unpredictable when Cloudfare is disabled. ![Screenshot 2023-02-09 at 11.56.27](https://us1.discourse-cdn.com/flex015/uploads/ghost2/original/3X/3/d/3daf42d5d9b71691dfd46adfc6514a8c751a8078.jpeg) ---
**Author:** ![markstos](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/markstos/32/18182_2.png) [@markstos](https://forum.ghost.org/u/markstos)\ **Post date:** [February 9, 2023, 12:06pm UTC](https://forum.ghost.org/t/ssl-handshake-failed-error-code-525/36163/7 "2023-02-09T12:06:09Z")
When you enable or disable Cloudflare, the DNS must be changing. DNS gets cached and can take sometimes hours for changes to be reflected. So after you turn Cloudflare on or off, you need to check if the DNS for the domain is resolving directly to the server or to Cloudflare. From your laptop terminal: ``` dig yourdomain.com ``` You’ll get back an IP address. Does it belong to the server itself or to Cloudflare? I recommend keeping Cloudflare off until the site is working. Setting it up at the same time makes troubleshooting more complex. ---
**Author:** ![tobitech](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/tobitech/32/22982_2.png) [@tobitech](https://forum.ghost.org/u/tobitech)\ **Post date:** [February 9, 2023, 12:40pm UTC](https://forum.ghost.org/t/ssl-handshake-failed-error-code-525/36163/8 "2023-02-09T12:40:15Z")
Yes I have completely disabled Cloudfare since the last reply. `dig theboujeetrybe.com` returns the IP of the server itself. ![Screenshot 2023-02-09 at 13.34.22](https://us1.discourse-cdn.com/flex015/uploads/ghost2/original/3X/5/2/52dafbcf2978b80f2691008cbd4de757c8a26350.jpeg) ---
**Author:** ![markstos](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/markstos/32/18182_2.png) [@markstos](https://forum.ghost.org/u/markstos)\ **Post date:** [February 9, 2023, 1:36pm UTC](https://forum.ghost.org/t/ssl-handshake-failed-error-code-525/36163/9 "2023-02-09T13:36:40Z")
Usually websites only have a single IP unless they are behind a load balancer. Are you sure both those IP addresses are for the server? Can you SSH to both of them? ---
**Author:** ![tobitech](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/tobitech/32/22982_2.png) [@tobitech](https://forum.ghost.org/u/tobitech)\ **Post date:** [February 9, 2023, 2:41pm UTC](https://forum.ghost.org/t/ssl-handshake-failed-error-code-525/36163/10 "2023-02-09T14:41:23Z")
Oh that’s true. Didn’t pay attention to the the two IPs. For some reason I’m not sure when that IP was added to the DNS and points to the same domain. I have removed the second IP from DNS and just kept the one for the Digital Ocean server where Ghost is installed. ![Screenshot 2023-02-09 at 15.39.02](https://us1.discourse-cdn.com/flex015/uploads/ghost2/original/3X/a/a/aa118835327b47294feb1b7505f65558931960e4.jpeg) Do you think this one would solve the instability issues? Thanks ---
**Author:** ![Cathy\_Sarisky](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/cathy_sarisky/32/25750_2.png) [@Cathy\_Sarisky](https://forum.ghost.org/u/Cathy_Sarisky)\ **Post date:** [February 9, 2023, 2:44pm UTC](https://forum.ghost.org/t/ssl-handshake-failed-error-code-525/36163/11 "2023-02-09T14:44:39Z")
It’s definitely a possible source - when you get two DNS answers like that, the browser picks one rather randomly. Whether that’s the only problem remains to be seen once the old result clears the cache. ---
**Author:** ![markstos](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/markstos/32/18182_2.png) [@markstos](https://forum.ghost.org/u/markstos)\ **Post date:** [February 9, 2023, 4:06pm UTC](https://forum.ghost.org/t/ssl-handshake-failed-error-code-525/36163/12 "2023-02-09T16:06:29Z")
[https://theboujeetrybe.com/](https://theboujeetrybe.com/) is loading for me now. 🚀 ---
**Author:** ![tobitech](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/tobitech/32/22982_2.png) [@tobitech](https://forum.ghost.org/u/tobitech)\ **Post date:** [February 9, 2023, 5:04pm UTC](https://forum.ghost.org/t/ssl-handshake-failed-error-code-525/36163/13 "2023-02-09T17:04:26Z")
Yes it’s working now, even without Cloudfare 🎉 Haven’t seen an issue in a while. Thank you guys.