TLS & SSL Certificate Errors

Understanding TLS errors

TLS errors have a small number of root causes: the certificate is expired, the hostname does not match any SAN entry, the chain is incomplete (the server did not send its intermediates), the issuing CA is not trusted by this client, or the two sides share no cipher or protocol version. The incomplete-chain case is the most deceptive, because browsers often paper over it with cached intermediates while curl, Java and Go fail.

How to debug TLS errors

1. Inspect the live handshake: openssl s_client -connect host:443 -servername host -showcerts. It shows the full chain the server actually sends.
2. Check dates and SANs: openssl x509 -noout -dates -subject -ext subjectAltName. The Common Name is ignored by modern clients: only SANs matter.
3. If browsers work but curl or your language runtime does not, suspect a missing intermediate. Browsers cache intermediates; other clients do not.
4. Verify the trust store the failing client uses. Containers frequently ship without ca-certificates installed, and Java, Node and Python each have their own store.
5. For protocol or cipher errors, check the negotiated version and the server's supported list. TLS 1.0 and 1.1 are disabled by default in current clients.

Tools worth reaching for

• openssl s_client
• openssl x509 -noout -text
• curl -vI
• testssl.sh
• sslyze

All 24 TLS errors

• Apache mod_ssl errorApache's SSL module encountered an error, often due to misconfigured SSL directives.
• Certificate chain incompleteSSL certificate chain is missing intermediate certificates, causing trust validation to fail.
• Certificate has expiredThe SSL certificate is past its expiration date and is no longer valid for secure connections.
• Client certificate requiredServer requires client certificate authentication but none was provided.
• curl: (56) OpenSSL SSL_read: Connection reset by peerThe SSL connection was abruptly closed by the remote server, often due to protocol mismatch or server configuration…
• ERR_SSL_PROTOCOL_ERRORBrowser detected an SSL protocol violation or misconfiguration. Often caused by mixed HTTP/HTTPS content or outdated…
• Hostname verification failedThe SSL certificate's hostname doesn't match the requested domain name.
• Invalid SSL certificateThe SSL certificate is malformed, self-signed, or doesn't meet security requirements.
• Mutual TLS verification failedMutual TLS authentication failed due to invalid client certificate or trust chain issues.
• OpenSSL: unsafe legacy renegotiation disabled NewOpenSSL 3 refuses to talk to servers that do not support RFC 5746 secure renegotiation. The peer is an old appliance…
• PEM error: no start line / unable to load private keyThe PEM file is malformed, missing its BEGIN header, contains CRLF/extra whitespace, or was base64-decoded/encoded…
• Protocol downgrade detectedPotential security attack detected where connection is being forced to use weaker protocols.
• SSL certificate validation failedCertificate validation failed due to expired cert, wrong hostname, or untrusted CA.
• SSL handshake failedThe SSL/TLS handshake process failed, often due to protocol version mismatch or cipher incompatibility.
• SSL peer certificate verification failedThe peer's SSL certificate could not be verified against known Certificate Authorities.
• SSL renegotiation failedSSL/TLS renegotiation process failed, often due to security policies or implementation bugs.
• SSL SNI (Server Name Indication) errorServer doesn't support SNI or client didn't send the server name, causing SSL certificate mismatch.
• SSL version or cipher mismatchClient and server don't support compatible SSL/TLS versions or cipher suites.
• SSL version rollback attackDetected attempt to force connection to use older, vulnerable SSL/TLS versions.
• SSL weak cipher rejectedServer or client rejected connection due to weak or deprecated cipher suites being offered.
• TLS: certificate is not yet valid NewThe certificate's notBefore date is in the future according to the client. The certificate is almost always fine: the…
• TLS: SSL_ERROR_SYSCALL / connection reset during handshake NewThe TCP connection was torn down mid-handshake, so TLS never got a protocol-level alert to report. Typically a…
• TLS: unable to get local issuer certificate NewThe client built a partial chain and could not reach a trusted root. Either the server omitted its intermediate…
• x509: certificate signed by unknown authorityThe SSL certificate was signed by a Certificate Authority that isn't trusted by the client system.

Other categories

• AI 35Rate limits, context windows, GPU memory and model-serving failures.
• Ansible 10Unreachable hosts, become passwords, undefined variables and Jinja2 failures.
• API 14Auth headers, payload limits, versioning, idempotency and webhook signatures.
• Apple 10Command line tools, dyld, Homebrew permissions, notarisation and Keychain.
• Auth 11OIDC, SAML, Auth0, Okta, Keycloak, passkeys and MFA failures.
• BigData 11Spark, Kafka, Airflow, Snowflake, Flink and Databricks failures.
• C# 12NuGet restore, null references, EF Core migrations, async deadlocks and Blazor…
• C++ 11Segfaults, linker errors, memory corruption and template deduction failures.
• Caching 10Cache stampedes, stale content, Varnish and CloudFront failures.
• CI/CD 18GitHub Actions, GitLab CI, Jenkins, CircleCI: permissions, runners and…
• Client 21CORS, mixed content, module resolution, memory limits and framework runtime…
• Cloud 25IAM permissions, quotas, service limits and credential failures.
• Dart 10Null safety, pub version solving and build toolchain problems.
• Database 41Connections, deadlocks, constraints, replication and memory limits.
• DNS 10NXDOMAIN, SERVFAIL, timeouts, propagation and delegation problems.
• Docker 27Daemon connectivity, disk space, image pulls, ports and architecture mismatches.
• Elixir 9GenServer timeouts, supervision failures and Mix compilation problems.
• Email 8Delivery failures, relay denial, authentication, SPF, DKIM and DMARC.
• Frontend 23Hydration mismatches, bundler resolution, layout shift and font loading.
• Git 20Merge conflicts, rejected pushes, detached HEAD, LFS and repository corruption.
• Go 19Nil map assignment, concurrent map access, context cancellation and deadlocks.
• GraphQL 13Validation, depth limits, N+1 queries and fragment problems.
• gRPC 10Status codes, deadlines, message limits, TLS and HTTP/2 transport failures.
• HTTP 494xx client errors, 5xx server errors, redirects, headers and protocol problems.
• ICMP 23Destination unreachable, time exceeded, fragmentation needed and redirects.
• Ingress 8404 default backend, missing TLS secrets, IngressClass and path matching.
• Java 19Class loading, dependency resolution, connection pools and JVM version…
• JavaScript 42npm resolution, async pitfalls, hydration, memory limits and runtime type…
• Kubernetes 34CrashLoopBackOff, ImagePullBackOff, OOMKilled, RBAC, scheduling and storage.
• Logging 9Log4j, Logback, Fluentd, Logstash and CloudWatch ingestion problems.
• MessageQueue 14Kafka, RabbitMQ, SQS, NATS and Celery: lag, rebalancing and poison messages.
• Mobile 17Gradle, CocoaPods, Xcode signing, Metro bundler and toolchain mismatches.
• Monitoring 12Prometheus scrapes, Grafana data sources, OpenTelemetry exporters and agent…
• Network 35Refused connections, timeouts, resets, MTU problems and port exhaustion.
• Performance 6GC pauses, thread pool starvation and event loop blocking.
• PHP 11Memory limits, execution timeouts, autoloading, Composer and PDO connections.
• Proxy 17nginx, Envoy, HAProxy, Traefik, Caddy and Cloudflare upstream failures.
• Python 35Imports, virtual environments, encoding, concurrency and dependency conflicts.
• Regex 8Catastrophic backtracking, back references, escaping and engine differences.
• Ruby 11Bundler, migrations, native extensions, encoding and asset compilation.
• Rust 19Borrow checker, ownership moves, trait bounds and lifetime mismatches.
• Scala 6Dependency resolution, binary compatibility and type inference failures.
• Security 25JWT validation, CSRF, OAuth grants, SELinux, SSH host keys and CSP.
• Serverless 11Lambda timeouts, package size limits, VPC networking and cold starts.
• Shell 13Command not found, permissions, quoting, expansion and Makefile syntax.
• Storage 13S3 permissions, NFS mounts, quotas, signed URLs and volume attachment.
• Svelte 10Store subscriptions, load functions and server/client boundaries.
• System 26Disk space, systemd units, file descriptors, OOM killer and scheduled jobs.
• Terraform 18State locks, provider auth, drift, dependency cycles and plan-time unknowns.
• Testing 18Jest, pytest, JUnit, Cypress and Playwright: fixtures, snapshots and timeouts.
• TypeScript 19Assignability, missing declarations, strict null checks and generic constraints.
• Virtualization 8VirtualBox, VMware, Hyper-V, WSL, KVM and hypervisor conflicts.
• Web3 7Gas estimation, nonce management and reverted transactions.
• WebAssembly 7Compile errors, memory bounds and host binding mismatches.
• WebServer 10nginx, Apache, IIS and Caddy: binding, permissions, rewrites and TLS.
• Windows 10Installer failures, missing runtimes, update errors and permission problems.