Error map
SSLCertificateFile: file does not exist Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty
SSL / TLS · layer 2, Network
Centre: this error. First ring: errors it is linked with (12). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (12)
ERR_TOO_MANY_REDIRECTS with Cloudflare (Flexible SSL redirect loop)
The page redirects to itself forever — classic cause: Cloudflare SSL mode “Flexible” while the origin redirects HTTP to HTTPS.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain)
Cloudflare has no edge certificate for the hostname — the Universal SSL cert is still pending, or the hostname is a second-level…
Apache: AH00558: apache2: Could not reliably determine the server's fully qualified domain name
A harmless startup warning: Apache has no global ServerName, so it guessed one from the host’s IP.
NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied)
Cloudflare Origin CA certificates are only trusted by Cloudflare — visitors reaching the origin directly (grey-cloud record, dire…
Node.js: Error: unable to verify the first certificate (code: UNABLE_TO_VERIFY_LEAF_SIGNATURE)
Node could not verify the server's leaf certificate because the intermediate certificates were not provided by the server.
Windows/IIS: A specified logon session does not exist / The certificate does not have a private key associated with it
IIS cannot bind an HTTPS site because the imported certificate has no private key attached.
Android/OkHttp: javax.net.ssl.SSLPeerUnverifiedException: Certificate pinning failure! Peer certificate chain: sha256/... Pinned certificates for api.example.com
The app's pinned certificate/public-key hash does not match the one the server presented, so OkHttp blocked the request.
OpenSSL/Nginx/Apache: error:0909006C:PEM routines:get_name:no start line / unable to load Private Key
The server or tool cannot read the private key file — wrong format, encrypted with a passphrase, wrong path, or a certificate pas…
Nginx: [emerg] no "ssl_certificate" is defined for the "listen ... ssl" directive in /etc/nginx/sites-enabled/default:3
A server block listens with `ssl` but has no `ssl_certificate` and `ssl_certificate_key`.
SSL Labs: Chain issues: Incomplete — Extra download (intermediate certificate missing)
The server sends only its own certificate and not the intermediate CA(s), so some clients cannot build a trusted chain.
Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name
Apache's SSL virtual host name does not match any name inside the certificate it loads.
iOS: Error Domain=NSURLErrorDomain Code=-1202 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be 'example.com'"
iOS rejected the server's certificate (untrusted issuer, name mismatch, expired, or weak).
Two steps away (34)
HTTP 301 Moved Permanently
The resource has a new permanent URL; clients and search engines should use the address in the Location header from now on.
HTTP 302 Found (Temporary Redirect)
The resource is temporarily at another URL; clients should keep using the original URL for future requests.
Cloudflare Error 525: SSL Handshake Failed
Cloudflare couldn’t complete a TLS handshake with your origin (SSL mode Full / Full strict).
SSL: CERTIFICATE_VERIFY_FAILED / unable to get local issuer certificate
The client couldn’t verify the server’s TLS certificate chain, so it refused the HTTPS connection.
fatal: unable to access 'https://…': SSL certificate problem: unable to get local issuer certificate
Git doesn’t trust the HTTPS server’s certificate — corporate proxy, self-hosted Git with an internal CA, or outdated CA bundle.
javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target
Java doesn’t trust the server’s certificate chain (self-signed, corporate proxy CA, or missing intermediate).
HTTP 413 Content Too Large (Request Entity Too Large)
The request body is bigger than the server is willing to accept — usually a file upload over the configured limit.
OAuth Error: redirect_uri_mismatch
The redirect URI in your OAuth request doesn’t exactly match one registered for the client in the provider’s console.
WordPress: Error Establishing a Database Connection
WordPress can’t connect to its MySQL/MariaDB database with the credentials in wp-config.php, or the database server is down.
Cloudflare Error 526: Invalid SSL Certificate
With SSL mode Full (strict), the origin’s certificate is expired, self-signed, or doesn’t match the hostname.
NET::ERR_CERT_AUTHORITY_INVALID (Your connection is not private)
The site’s certificate isn’t signed by a CA the browser trusts — self-signed, missing intermediates, or intercepted by a proxy.
NET::ERR_CERT_DATE_INVALID (certificate expired)
The site’s certificate has expired (or isn’t valid yet) — or the device clock is wrong.
npm ERR! code SELF_SIGNED_CERT_IN_CHAIN — request to https://registry.npmjs.org/ failed, reason: self signed certificate in certificate chain
A corporate proxy or antivirus is intercepting HTTPS, and npm doesn’t trust its certificate.
OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED
The client could not build a chain from the server's certificate to a CA it trusts — the issuer is missing locally or the server…
Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem)
The ACME validation server could not reach your server on port 80 within the timeout.
OpenSSL: Error outputting keys and certificates — Mac verify error: invalid password?
A `.p12`/`.pfx` file could not be opened because the password is wrong, or its encryption is unsupported by your OpenSSL version.
.NET: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel
A .NET client could not validate the server certificate or negotiate TLS, so the HTTPS call failed.
curl (Windows Schannel): schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate
Windows could not contact the CA's CRL/OCSP servers to check whether the certificate is revoked, so Schannel aborted.
Dart: HandshakeException: Handshake error in client (OS Error: CERTIFICATE_VERIFY_FAILED: unable to get local issuer certificate)
The app refused the server's TLS certificate because it is self-signed, expired, missing intermediates, or the device clock/CA st…
Let's Encrypt/CA: CAA record for example.com prevents issuance
The domain's DNS CAA records do not list the certificate authority you asked, so the CA must refuse.
gRPC: rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: x509: certificate signed by unknown authority"
A gRPC client could not complete TLS to the server — untrusted certificate, name mismatch, or plaintext/TLS mismatch.
OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch)
OpenSSL (or Nginx/Apache) couldn’t read the certificate or key — wrong file format, wrong file, or the key doesn’t match the cert…
OpenSSL: verify error:num=10:certificate has expired — notAfter=Jan 1 00:00:00 2025 GMT
OpenSSL's verification found a certificate in the chain whose validity period has ended.
OpenSSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number
The peer did not answer with a TLS record — you spoke TLS to a plain HTTP/SMTP port (or the reverse), or a proxy intervened.
ERR_SSL_PROTOCOL_ERROR (This site can't provide a secure connection)
The browser couldn’t negotiate TLS — the server sent an invalid response, often plain HTTP on the HTTPS port.
OpenSSL: SSL alert number 112 — tlsv1 unrecognized name
The server did not recognise the hostname sent in SNI and rejected the handshake (or an alert/warning is logged).
Nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/ssl/server.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)
The private key does not belong to the certificate configured in the server.
TypeError [ERR_INVALID_ARG_TYPE]: The "path" argument must be of type string. Received undefined
A Node API got an argument of the wrong type — usually undefined because an env var or config value is missing.
django.core.exceptions.ImproperlyConfigured: settings are not configured / SECRET_KEY must not be empty
Django can’t load its settings — DJANGO_SETTINGS_MODULE unset, a required setting missing, or an environment variable not provide…
django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: 'x'. You may need to add 'x' to ALLOWED_HOSTS.
The request’s Host header isn’t listed in Django’s ALLOWED_HOSTS.
Firefox: Peer's Certificate has expired. Error code: SEC_ERROR_EXPIRED_CERTIFICATE
Firefox found an expired certificate in the chain presented by the server.
Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN
The certificate does not include the hostname you typed.
Node/OpenSSL: Error: self signed certificate (code: DEPTH_ZERO_SELF_SIGNED_CERT)
The server presented a self-signed certificate (issuer equals subject), which no CA vouches for.
Safari: Safari Can’t Open the Page — A TLS error caused the secure connection to fail
Safari could not set up a secure TLS connection — an expired or untrusted certificate, an outdated server configuration or interf…
Map another error
Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError