Guides

SSL/TLS and certificate errors

TLS errors come from one of two phases: the handshake (protocol and cipher negotiation) or certificate validation (is this really the server I asked for?). Validation errors are the common ones, and every one of them has a correct fix that is not "turn verification off."

The validation failures

See what the server actually serves

openssl s_client -connect api.example.com:443 -servername api.example.com | \
  openssl x509 -noout -dates -subject -ext subjectAltName

That one command answers most tickets: the real expiry dates, the names the cert covers, and (in the full s_client output) whether the intermediate is in the served chain. Compare against what your code dials — including the port and the exact hostname, since SNI means different names can get different certificates from the same IP.

Fix the trust, don't disable it

NODE_TLS_REJECT_UNAUTHORIZED=0, verify=False, InsecureSkipVerify: true — every stack has the same trapdoor, and it turns "TLS error in staging" into "silent man-in-the-middle in production" the day the snippet gets copied. The correct moves: renew (and automate renewal), add your internal CA to the trust store (NODE_EXTRA_CA_CERTS, REQUESTS_CA_BUNDLE, SSL_CERT_FILE, or the OS store), serve the full chain from the server, and dial the name the certificate is actually for. Scope any dev-only exception to a single explicit host, never process-wide.

Documented occurrences

2,662 analyzed errors across 357 libraries match this failure class. Each links to the thrown message, its source line, and documented fixes.

golang/go

• client doesn't support certificate curve
• client's certificate is not allowed in FIPS 140-3 mode
• server's certificate is not allowed in FIPS 140-3 mode
• tls: certificate cannot be used with the selected cipher suite
• tls: certificate private key does not implement crypto.Decrypter
• +125 more in go

quarkusio/quarkus

• Access token does not contain a confirmation 'cnf' claim with the certificate thumbprint
• Alias '${alias}' not found in JKS key store (certificate not found)'${name}'
• Alias '${alias}' not found in JKS trust store (certificate not found)'${name}'
• Alias '${alias}' not found in key store (certificate not found) '${name}'
• Alias '${alias}' not found in P12 key store (certificate not found)'${name}'
• +106 more in quarkus

caddyserver/caddy

• access control %d public key %d: parsing base64 certificate DER: %v
• accessing certificate file: %v
• 'ca' module '%s' is not a certificate pool provider
• CA %s has a nil certificate in its intermediate chain
• CA %s has no root certificate
• +79 more in caddy

hyperledger/fabric

• An X509 certificate with Basic Constraint: Certificate Authority equals true cannot be used as an identity
• authorityKeyIdentifier not found in certificate
• both Key and Certificate are required when using mutual TLS
• CA Certificate did not have the CA attribute, (SN: %x)
• certificate extracted from TLS connection isn't authorized
• +70 more in fabric

kubernetes/kops

• AsBytes called on nil Certificate
• AsString called on nil Certificate
• ca certificate for %q was not found; cannot issue certificates
• ca key for %q was not found; cannot issue certificates
• cannot find CA certificate
• +60 more in kops

slackhq/nebula

• ca certificate is expired
• can not sign a CA certificate with another
• can not use pki.initiating_version 1 without a v1 certificate in pki.cert
• certificate contained a group not present on the signing ca: %s
• certificate contained a network assignment outside the limitations of the signing ca: %s
• +54 more in nebula

cert-manager/cert-manager

• cert bundle didn't contain any valid certificates
• certificate authority stopped unexpectedly
• certificate not available
• certificate request contains no Common Name, DNS Name, nor URI SAN, at least one must be supplied to be used as the certificate objects name
• Certificate requests submitted to Venafi issuers must have the 'commonName' field or at least one other subject field set.
• +47 more in cert-manager

grpc/grpc-java

• ca_certificate_provider_instance name '${rootCaInstanceName}' not defined in the bootstrap file.
• ca_certificate_provider_instance or system_root_certs is required in upstream-tls-context
• Can't set TLS settings for ALTS
• Certificate can't be parsed. Certificate loading for trust domain '%s' failed.
• Certificate file not found or not readable: ${trustCertFile.getAbsolutePath()}
• +40 more in grpc-java

cilium/cilium

• CA certificate file %s is not a valid PEM encoded certificate
• cannot merge conflicting originating TLS contexts for cached selector %s: (%s/%s)
• cannot merge conflicting terminating TLS contexts for cached selector %s: (%s/%s)
• cannot merge L7 rules for cached selector %s with SNI filtering without TLS termination: %v
• cannot process cert '%s': must be a PEM encoded certificate
• +39 more in cilium

t8y2/dbx

• both client certificate and client key are required
• Client certificate and key must be provided together
• Client certificate and key must be provided together
• Client certificate and key must be provided together
• <dynamic SQLException message>\n\nDBX SQL Server legacy TLS diagnostics: java=${java.version}, javaVendor=${java.vendor}, jdbc=${driverVersion}, sslProtocol=TLSv1, tlsV1Disabled=${...}, tlsRsaDisabled=${...}, rsaPkcs1Sha1HandshakeDisabled=${...}, 3desDisabled=${...}, rc4Disabled=${...}
• +34 more in dbx

…and 347 more libraries — search for your exact message.

Other failure classes

• Connection failures: ECONNREFUSED, ECONNRESET, and friends
• DNS resolution errors: ENOTFOUND and getaddrinfo failures
• Timeouts: ETIMEDOUT, deadlines, and hung requests
• HTTP status errors: handling 4xx and 5xx responses
• Authentication and authorization failures
• Parsing and encoding errors: unexpected token, malformed input