Cloudflare Enterprise Errors 525, 526 and 1014, and the www Hostname

After you enable the Cloudflare Enterprise add-on, your site is served through Cloudflare’s Enterprise edge, which connects to your xCloud server as the origin. Most problems after activation show up as a Cloudflare error page with a code. The code tells you which layer failed, and almost every case comes down to one of four things: the www hostname, a DNS record, the origin certificate, or doing the DNS cutover too early.

This guide goes code by code. Before you start, open the site in xCloud and go to its Cloudflare Enterprise page. The Ownership Verification section and its Records list are the source of truth for every record mentioned below.

First rule: follow the order the panel shows

Most failed activations come from adding a routing record at the wrong moment. The panel groups the records so the order is clear:

1. Add the records under Safe to add anytime first: the ownership and certificate validation records.
2. Add the records under Live traffic cutover when you are ready for traffic to move. If your routing record is a CNAME, adding it is what activates the domain.
3. If your DNS provider needs an ALIAS or A records at the root, add them only after the domain shows Active. Cloudflare will not verify a domain that already points at its own addresses.

Each DNS name can hold only one A, AAAA or CNAME record. Adding the routing record replaces whatever is live for that name. If your zone is connected to xCloud through the Cloudflare integration, Verify & Add Records does all of this for you.

For step-by-step instructions, see the guides for Google Cloud DNS, AWS Route 53, Namecheap, and Cloudflare without an xCloud integration.

Error 1014: CNAME Cross-User Banned (usually www)

What it means. The hostname points directly at the xCloud edge hostname (edge.xcloud.app) instead of the Cloudflare Enterprise CNAME target assigned to your site. Cloudflare refuses the request because the record crosses between two Cloudflare accounts. The apex typically works while www fails, because www was set up earlier or by hand.

Fix.

1. On the site’s Cloudflare Enterprise page, open Ownership Verification and find the www row under Records. Copy the CNAME target shown there.
2. In your DNS provider, edit the www record: type CNAME, target = the value you copied. If the record is proxied in your own Cloudflare account, leave it as the dashboard instructs.
3. Back in xCloud, click Refresh status.

A root domain purchase already covers www at the edge. If www still shows 1014 after the record is correct, wait, or click Refresh status again later. xCloud restores the www coverage automatically, during its background check every 15 minutes or on a refresh, as long as the _acme-challenge CNAME record is still in place. If that record is missing, add it back from the panel, or contact support.

If you do not want a separate www site, you still need www to resolve correctly before a redirect can work. Set the record as above, then handle the redirect in the site’s Domains settings rather than in your own Cloudflare rules.

Error 526: Invalid SSL certificate

What it means. The Enterprise edge connected to your origin with strict certificate checking, and the certificate it received does not validly cover the requested hostname.

Sites hosted on xCloud. The edge connects to your server through a dedicated origin with a certificate xCloud installs on the server, so your site’s own certificate does not need to cover www for the edge.

First, check the domain row for an origin certificate notice. If xCloud could not install the origin certificate on your server, the domain on the site’s Cloudflare Enterprise page shows a red notice: “Cloudflare Enterprise could not install its origin certificate on this server. xCloud retries every hour; if visitors see Cloudflare error 526, contact support.” The domain’s status can still read Active while this notice shows, so the notice, not the status, tells you the certificate is missing.

When you see that notice:

• You don’t need to do anything for the retry. xCloud tries the install again about once an hour and the notice disappears once a certificate is in place.
• If visitors see a 526, contact support with the domain. Support can retry the certificate install right away instead of waiting for the next hourly attempt.
• Do not disable and re-enable the domain for this. Re-enabling does not skip the hourly wait, and it takes the domain off the edge while it runs.

Fix (no origin certificate notice).

1. On the site’s Cloudflare Enterprise page, open the domain row’s actions menu and select Refresh status. xCloud checks the origin certificate and the connection settings between the edge and your server, and repairs them automatically.
2. Wait a few minutes and reload the URL.
3. If the error continues, select Disable for the domain, wait for it to finish, then select Enable. Re-enabling registers the domain again and reinstalls the origin certificate if it is missing. While disabled, the site serves directly from your server, so confirm DNS still points at it if the site is unreachable in that window.

External domains. If your own server’s certificate does not cover the other name of the pair (www or the root domain), xCloud redirects it to the name you bought instead of showing a 526. The domain page shows a note saying so. Add the missing name to your server’s certificate. xCloud checks your server’s certificate at most once an hour, so the redirect is removed within about an hour.

If the 526 persists after these steps, contact support with the domain and the time you saw the error.

Error 525: SSL handshake failed

What it means. The edge reached your server but the TLS handshake between Cloudflare and the origin did not complete. This is on the connection between the Enterprise network and your server, not on your DNS and not on your browser.

Fix.

1. Do not change your SSL mode, and do not reissue certificates from your own Cloudflare account or your previous host. Your server’s certificate is almost always fine.
2. Select Refresh status. xCloud checks and corrects the connection settings between the edge and your server automatically.
3. If the error continues after 15 minutes, contact support with the domain and the time you saw the error.

If an external domain’s page says Origin server needed, visitors see a 522 error instead: enter your server’s public IP address or hostname in the Origin Server card and select Save Origin.

Error 1000: DNS points to prohibited IP

What it means. Your apex domain uses Cloudflare nameservers and you pointed it at Cloudflare’s own IP addresses (for example as fallback A records). Cloudflare rejects this.

Fix. Remove those A records. On Cloudflare DNS, use the CNAME the dashboard shows for the apex; Cloudflare flattens it automatically. Use A records only on providers that cannot do CNAME flattening, and only the ones the dashboard lists.

Error 400: Request Header or Cookie Too Large

What it means. The request headers, usually the cookies, are larger than your server accepts. A site that sets many cookies, or one very large cookie, can trip this limit.

Fix. On Nginx servers, xCloud already allows each request header line to be up to 64 KB for Cloudflare Enterprise traffic, and a server-level Nginx Customization cannot raise it further. If you still see this error, a cookie is larger than that. Find which cookies are growing and trim them. For sites without Cloudflare Enterprise, see How to Fix “400 Bad Request: Request Header or Cookie Too Large”.

“Cannot add the CNAME, an A record already exists”

DNS providers do not allow a CNAME next to an A record for the same name. Delete the old A record for that hostname, then add the CNAME the dashboard shows and click Refresh status. If the zone is connected to xCloud, use Verify & Add Records instead.

Still not working?

Open a ticket with:

• the domain and whether the apex, www or both are affected,
• the exact error code and the time you saw it,
• a screenshot of the Records list on the Cloudflare Enterprise page.

If you run into any issues with the add-on, feel free to reach out to our support team.

Frequently asked questions

My main domain works but www shows Error 1014. Why?

The www record is pointing straight at the xCloud edge hostname instead of the Cloudflare Enterprise CNAME target shown on the site’s Cloudflare Enterprise page. Point www at that target and click Refresh status.

Do I need to add www as an additional domain on the site?

Not for the edge. A root domain or www purchase covers both names. On an external domain, if your own server’s certificate does not cover the other name, xCloud redirects it to the name you bought until the certificate covers it. Add www in the site’s Domains settings only to control how your site itself serves it.

Should I change my SSL mode or reissue a certificate when I see a 525 or 526?

No. Leave the SSL mode and certificates alone. These errors come from the hostname or origin configuration, and changing SSL settings usually makes them harder to trace. Follow the steps for the specific error code instead.

The Cloudflare Enterprise page says it could not install its origin certificate, but the domain shows Active. Is it working?

The status reflects the domain at Cloudflare, not the certificate on your server, so it can read Active while the notice shows. xCloud retries the install about once an hour. If visitors see Cloudflare error 526, contact support, who can retry it right away. You don’t need to disable and re-enable the domain.