Error map
x509 (kubectl) Unable to connect to the server: x509: certificate has expired or is not yet valid / certificate signed by unknown authority
Kubernetes · layer 6, Platform & cloud
Centre: this error. First ring: errors it is linked with (12). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (12)
error: You must be logged in to the server (Unauthorized)
The cluster rejected kubectl’s credentials — expired token, wrong kubeconfig user, or cloud IAM identity not allowed.
Unable to connect to the server: dial tcp <ip>:443: i/o timeout
kubectl can’t reach the API server at all — network path, VPN, firewall or a private endpoint you’re outside of.
Cloudflare Error 1013: HTTP hostname and TLS SNI hostname mismatch
The TLS SNI (the hostname used for the certificate) differs from the HTTP Host header in the same request.
SSL: CERTIFICATE_VERIFY_FAILED / unable to get local issuer certificate
The client couldn’t verify the server’s TLS certificate chain, so it refused the HTTPS connection.
error: the server doesn't have a resource type "x"
kubectl doesn’t know the resource name you typed — a typo, a CRD that isn’t installed, or a stale discovery cache.
Error from server (BadRequest): container "x" in pod "y" is waiting to start: ContainerCreating
kubectl logs has nothing to show yet — the container hasn’t started (still creating, pulling, or blocked).
ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain)
Cloudflare has no edge certificate for the hostname — the Universal SSL cert is still pending, or the hostname is a second-level…
HttpRequestException: The SSL connection could not be established, see inner exception. (AuthenticationException: The remote certificate is invalid)
HttpClient couldn’t complete the TLS handshake — untrusted/self-signed certificate, name mismatch, expired certificate, or TLS ve…
kubectl: The connection to the server localhost:8080 was refused — did you specify the right host or port?
kubectl has no usable kubeconfig, so it falls back to localhost:8080 — or the cluster API server is unreachable.
No resources found in default namespace
Not an error: kubectl found nothing of that kind in the namespace it looked in — usually because the resources are in another nam…
Error from server (NotFound): deployments.apps "x" not found
The named object doesn’t exist in the namespace/cluster kubectl is pointing at.
Error from server (AlreadyExists): ... already exists
kubectl create tried to make an object whose name is already taken in that namespace.
Two steps away (27)
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
Error from server (Forbidden): pods is forbidden: User "x" cannot list resource "pods" in API group "" in the namespace
You’re authenticated to the cluster, but RBAC doesn’t give your user or service account that verb on that resource.
error: no context exists with the name: "x"
kubectl was told to use a context that isn’t in the loaded kubeconfig file(s).
API Request Timed Out (ETIMEDOUT / ReadTimeout / timeout of 30000ms exceeded)
The client gave up waiting — either for the connection to open or for the response to arrive.
Windows Update error 0x8024402C (cannot connect to update server)
Windows Update can’t reach Microsoft’s servers — a proxy, DNS, firewall or WSUS setting is blocking the connection.
Error 0x80072EE7 (Windows Update / Microsoft Store: server name could not be resolved)
Windows can’t resolve Microsoft’s server names — DNS, hosts file, proxy or firewall problems.
fatal: unable to access 'https://…': SSL certificate problem: unable to get local issuer certificate
Git doesn’t trust the HTTPS server’s certificate — corporate proxy, self-hosted Git with an internal CA, or outdated CA bundle.
javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target
Java doesn’t trust the server’s certificate chain (self-signed, corporate proxy CA, or missing intermediate).
NET::ERR_CERT_AUTHORITY_INVALID (Your connection is not private)
The site’s certificate isn’t signed by a CA the browser trusts — self-signed, missing intermediates, or intercepted by a proxy.
HTTP 502 Bad Gateway
A proxy or gateway (Nginx, load balancer, CDN) got an invalid response — or no response — from the upstream server behind it.
TypeError: Failed to fetch / NetworkError when attempting to fetch resource
The browser couldn’t complete the request at the network level — CORS, DNS, offline, blocked mixed content, or the server refused…
Cloudflare Error 520: Web Server Returned an Unknown Error
Cloudflare connected to your origin, but the origin returned an empty, unknown or invalid response.
no matches for kind "Ingress" in version "extensions/v1beta1" (resource mapping not found)
The manifest uses an apiVersion/kind the cluster doesn’t serve — a removed beta API, or a CRD that isn’t installed.
Kubernetes: CrashLoopBackOff
The container starts, crashes (or exits), and Kubernetes keeps restarting it with increasing back-off delays.
HTTP 500 Internal Server Error
The server hit an unexpected condition — usually an unhandled exception or misconfiguration in the application.
HTTP 499 Client Closed Request (Nginx)
Nginx-specific code logged when the client disconnected before the server finished responding.
Cloudflare Error 525: SSL Handshake Failed
Cloudflare couldn’t complete a TLS handshake with your origin (SSL mode Full / Full strict).
NET::ERR_CERT_DATE_INVALID (certificate expired)
The site’s certificate has expired (or isn’t valid yet) — or the device clock is wrong.
ERR_SSL_PROTOCOL_ERROR (This site can't provide a secure connection)
The browser couldn’t negotiate TLS — the server sent an invalid response, often plain HTTP on the HTTPS port.
Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames
The server’s certificate doesn’t cover the hostname you connected to.
npm ERR! code SELF_SIGNED_CERT_IN_CHAIN — request to https://registry.npmjs.org/ failed, reason: self signed certificate in certificate chain
A corporate proxy or antivirus is intercepting HTTPS, and npm doesn’t trust its certificate.
npm ERR! code UNABLE_TO_GET_ISSUER_CERT_LOCALLY
npm can’t verify the registry’s certificate chain — missing intermediate or intercepted connection.
Error: connect ECONNREFUSED 127.0.0.1:5432
Nothing is listening at that host:port — the target service is down or you’re connecting to the wrong address.
Namespace stuck in Terminating
A deleted namespace never disappears because some resource inside it, or the namespace’s own finalizer, can’t be cleaned up.
API Error: Resource already exists (ALREADY_EXISTS / resource_already_exists / 409)
The create request was refused because an object with the same unique identity — name, email, external ID — already exists.
The Deployment is invalid: spec.selector: Invalid value: field is immutable
You tried to change a field Kubernetes doesn’t allow to change after creation — Deployment selectors, Job templates, Service clus…
strict decoding error: unknown field "spec.template.spec.containers[0].ports[0].protocl"
The manifest contains a field the API schema doesn’t know — a typo, wrong indentation, or a field from another API version.
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException