SSL/TLS Certificate Errors

Common SSL Errors

Diagnosing Certificate Issues

# Check certificate details
openssl s_client -connect example.com:443 -servername example.com

# View certificate info
echo | openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -dates -subject -issuer

# Check full certificate chain
openssl s_client -connect example.com:443 -showcerts

# Test specific TLS version
openssl s_client -connect example.com:443 -tls1_2
openssl s_client -connect example.com:443 -tls1_3

Certificate Expired

SSL certificates have a validity period (usually 90 days for Let's Encrypt, 1 year for paid certs). When expired, browsers refuse to connect.

# Check expiry date
echo | openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -enddate

# Renew Let's Encrypt certificate
sudo certbot renew

# Force renewal
sudo certbot renew --force-renewal

Hostname Mismatch

The certificate must match the domain being accessed. Check that the certificate covers the exact domain or uses a wildcard.

# Certificate covers:
# - example.com
# - www.example.com

# But NOT:
# - api.example.com (unless using *.example.com wildcard)
# - subdomain.api.example.com (wildcards are single-level)

# Check what names the cert covers
echo | openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -text | grep -A1 "Subject Alternative Name"

Self-Signed Certificates

Self-signed certs aren't trusted by browsers. Use Let's Encrypt for free trusted certificates.

# Install certbot and get a free certificate
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

# Or for Apache
sudo certbot --apache -d example.com

# Auto-renewal (add to crontab)
0 12 * * * /usr/bin/certbot renew --quiet

Missing Intermediate Certificate

Browsers need the full certificate chain. Missing intermediates cause errors on some clients.

# Test certificate chain
curl -vvI https://example.com 2>&1 | grep -A 10 "Server certificate"

# Nginx - include full chain
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

TLS Version Issues

# Nginx - modern TLS config
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers off;

Quick Fixes

• Expired cert: Renew with certbot renew
• Wrong domain: Reissue cert with correct SANs
• Self-signed: Switch to Let's Encrypt
• Chain incomplete: Use fullchain.pem, not just cert.pem
• Old TLS: Update to TLS 1.2 minimum

How to Monitor SSL Certificates

Expired SSL certificates drive users away with security warnings. UptimeSignal monitors your HTTPS endpoints and tracks certificate expiry, alerting you before certificates expire. Use our free SSL Checker to inspect your current certificate. See also: Port 443 (HTTPS), Connection Refused.

Frequently Asked Questions