For error 1044, use the full message and a client comparison to investigate the secure connection visitors make to Cloudflare. Keep that review distinct from Cloudflare’s separate origin connection.
Test the same hostname with a working current client and the client that fails. An integration can use a different TLS library from the browser on the same device.
Guide reviewed: October 8, 2026. Interface labels may vary by version, account and device.
Compare the failing client’s TLS capabilities
| Comparison | Evidence | Next check |
|---|---|---|
| Current browser works, older client fails | Client versions and TLS capability | Supported client update |
| Integration fails, browser works | Integration library and request | Its secure-connection capabilities |
| Failure after policy change | Previous and current TLS/cipher settings | Compatibility with the intended requirement |
| Several hostnames differ | Applicable hostname configuration | Review the matching policy |
| Origin certificate replaced, no change | Which connection is failing | Keep edge and origin tests separate |
Compare the clients that can and cannot connect
- Record the exact HTTPS hostname and full message.
- Test the same address with a current browser.
- Record the failing client and TLS-library version if known.
- Compare the applicable minimum version and cipher settings.
- Choose a correction that preserves the intended security requirement.
Note whether the problem occurs in one older browser, a particular integration client or every device tested. Use the same hostname and HTTPS address for each comparison so that you are testing the same connection.
If a current browser opens the page while an older client fails, compatibility deserves attention. That pattern does not identify a particular TLS version by itself, but it gives the administrator a concrete difference to investigate.
For an integration, record the software and version used to make the request. A background service may use a different TLS library from the browser on the same computer, so a successful browser visit does not verify that service’s connection.
Review the minimum TLS requirement
Cloudflare’s Minimum TLS Version setting limits connections to clients that support the selected version or newer. A client below that requirement cannot complete the intended connection. Compare the configured requirement with the capabilities of the failing client.
An update to the client may be the appropriate correction when it cannot support the site’s security requirement. Lowering the requirement affects the site’s connection policy and should not be the automatic response to one outdated device.
The administrator should also check whether settings differ for the affected hostname. A comparison between two addresses is useful only if you understand which configuration each address uses.
Keep cipher compatibility in the review
Protocols and cipher suites are related parts of TLS negotiation. A supported protocol alone does not establish that the client and configured connection have a compatible combination. If cipher settings were customized, review them alongside the minimum version.
A recent change can be a helpful clue. For example, an integration might stop working after the site’s connection requirements were tightened. Comparing the old and new configuration with the client’s documented capabilities is more useful than repeatedly trying the same request.
Do not infer a particular cipher problem solely from error 1044. The exact message, client diagnostics and applicable Cloudflare configuration should support that conclusion.
Separate the edge connection from the origin
An origin certificate is used on the Cloudflare-to-host connection. Replacing it does not necessarily address a failure between the visitor and Cloudflare. Cloudflare documents origin TLS failures separately, so the observed code and message should guide which side is investigated.
If the browser cannot establish the edge connection, WordPress may never receive the request. That explains why the site’s application logs may not contain a matching page visit. The absence of a PHP error does not make the visible connection failure imaginary.
A host can still help verify the origin configuration, but keep that check separate from the client compatibility review. Combining both sides into one general SSL diagnosis can lead to changes that have no effect on the failing connection.
Verify with the original failing client
Keep a small matrix of hostname, client version, applicable policy and result. A different browser succeeding is useful evidence but does not finish verification for the original integration.
After the identified correction, repeat the request using the client that originally failed. Then test a normal browser visit and another important integration, if applicable. The result should confirm both compatibility and the intended security requirements.
If support is needed, include the hostname, full message, time, client version and relevant TLS configuration changes. Do not share private keys or account credentials in a troubleshooting report. Those secrets are not needed to describe which connection failed.
Cloudflare’s Minimum TLS Version guide explains client compatibility. Its cipher troubleshooting guide covers the interaction with cipher settings. Use them alongside the complete error from your own request.
Keep compatibility and security in the result
Retest the original client and another important client after the correction. Document the supported versions and intended policy. Give support the full message and configuration change; private keys and credentials are unnecessary for describing the failed connection.