Error 525 setting up cloudflared https tunnel

Zero Trust Cloudflare Tunnel
1

What is the name of the domain?

cloudtest dimentech com

What is the error number?

525

What is the error message?

SSL handshake failed

What is the issue you’re encountering

Unable to access website via cloudflared tunnel

What are the steps to reproduce the issue?

Verified that local webserver is running, has correct SSL certificate, and has appropriate ciphers. The Apache configuration is identical to a public server I host. I followed the directions at eddiezme/working-around-cgnat/

I see the tunnel as active at Cloudflare. I don’t know of a way to see what error Cloudflare is getting when their side attempts the https connection to my local server. HTTPS works just fine locally to the server.

The SSLProtocal and SSLChipherSuite are:
SSLProtocol All -SSLv2 -SSLv3
SSLCipherSuite “EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4”

2

The easy solution is to use HTTP instead of HTTPS - there’s not much of a security concern if the tunnel and webserver are running on the same machine. Just make sure the webserver only responds to requests from localhost.

If you want to use HTTPS, can you share the tunnel’s ingress rules?

3

I was trying to use HTTPS because the SSL/TLS settings for the domain are set to “automatic”. I had set the ingress rules to HTTP originally but switched due to thinking the SSL/TLS automatic setting was an inssue.

config.yml rules (minus the tunnel and credential file lines) are:

ingress:

4

Could you set the originServerName option? If that alone doesn’t work, could you also add the httpHostHeader option? Origin configuration · Cloudflare Zero Trust docs

This does not apply to the tunnel. I would personally just change it HTTP, as it really doesn’t make much sense to encrypt the traffic on the web server only to have it decrypted by the tunnel to encrypt it again.

5

OK. Changed to http but still getting the 525 error. Updated config file below. I have verified using wget on the local server that “http://127.0.0.1” is returning the webpage I expect.

ingress:

6

Can you just doublecheck that the DNS record for cloudtest.dimentech.com actually points to your tunnel?

7

The CNAME record is set to thetunnelid.cgargotunnel.com and Proxy is ON
I see the tunnel status as active

Oddly, now I’m seeing “Error 1016 Origin DNS Error”. I had renentered the full CNAME record and made a typo. I fixed the typo but this is what I’m getting now. Do I have the wrong domain name for the CNAME destination?

8

is that just a typo? It’s cfargotunnel.com. But this typo would be consistent with the error you see.

9

Thank you! The webpage I was basing my setup off of had “cg” not “cf”. That, combined with my attempt at SSL was the root cause of my problems. With SSL removed and now with the correct spelling, it works.

Thank you!

1 Like