Bad Handshake Error when attempting to connect to my home server via SSH

Whenever I try to connect to my home server behind Cloudflare Access, I get an error that looks like this:

2022-10-16T00:39:04Z ERR failed to connect to origin error="websocket: bad handshake" originURL=redacted-application-url.example.com

Here’s some other information that may be useful in finding the reason:

I’m attempting to connect to my server running Ubuntu 22.04.2 LTS, from my Windows machine with the native SSH client that’s included with it (which I’m assuming is OpenSSH, considering it uses the exact same config scheme).
This only happens when I attempt to connect from the client on my machine. When I use the browser-based client, it works fine.

The config on my client:

Host redacted-application-url.example.com
  HostName redacted-application-url.example.com
  ProxyCommand cloudflared access ssh --hostname %h
  IdentityFile C:\Users\morgo\.cloudflared\redacted-application-url.example.com-cf_key
  CertificateFile C:\Users\morgo\.cloudflared\redacted-application-url.example.com-cf_key-cert.pub

Output from cloudflared -v on my client:
cloudflared version 2022.10.0 (built 2022-10-03-0947 UTC)

Output from cloudflared -v on my server:
cloudflared version 2022.10.0 (built 2022-10-03-0939 UTC)

The server usually runs the tunnel from systemd service, but I have tried running it directly on root, also with --loglevel debug set, however it did the same thing, and I also got no error on the server end.

The popup window created by Cloudflare Access says the token exchange was successful.

Any help is appreciated, and let me know if I need to provide more than this. Thanks!

Check your firewall logs. Since you’re going through Cloudflare, your request may be blocked by the firewall due to an overly restrictive setting.

I have my host’s firewall disabled (which I should definitely work on after this, thanks for reminding me :sweat_smile:)

and I tried allowing all in/outbound requests to and from cloudflared.exe through Windows Defender on my client, but nothing seems to have changed, unfortunately.