Error map
unable to get local issuer certificate OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED
SSL / TLS · layer 2, Network
Centre: this error. First ring: errors it is linked with (12). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (12)
OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch)
OpenSSL (or Nginx/Apache) couldn’t read the certificate or key — wrong file format, wrong file, or the key doesn’t match the cert…
Error: error:0308010C:digital envelope routines::unsupported
An old build tool (webpack 4, old react-scripts) uses a hash algorithm that OpenSSL 3 in Node 17+ disables.
Dart: HandshakeException: Handshake error in client (OS Error: CERTIFICATE_VERIFY_FAILED: unable to get local issuer certificate)
The app refused the server's TLS certificate because it is self-signed, expired, missing intermediates, or the device clock/CA st…
Node.js: Error: unable to verify the first certificate (code: UNABLE_TO_VERIFY_LEAF_SIGNATURE)
Node could not verify the server's leaf certificate because the intermediate certificates were not provided by the server.
curl: (60) SSL certificate problem: unable to get local issuer certificate
curl could not verify the server's certificate — missing CA, incomplete chain, self-signed or expired certificate.
curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none
curl cannot read the CA bundle file it is configured to use — missing file, wrong path or permissions.
Old clients: certificate has expired — Let's Encrypt chain uses expired DST Root CA X3 (OpenSSL 1.0.x, Android < 7.1.1)
Older systems fail to validate Let's Encrypt certificates because their trust store lacks ISRG Root X1 and relies on the expired…
OpenSSL: error:0A00018E:SSL routines::ca md too weak / error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small
OpenSSL's security level rejected a certificate signed with a weak hash (MD5/SHA-1) or with a small key (RSA < 2048).
Go: x509: certificate signed by unknown authority
The Go TLS client does not trust the CA that signed the server's certificate.
OpenSSL: error:14094410 / SSL alert number 70 — tlsv1 alert protocol version
The server rejected the TLS version your client offered, because it requires a newer (or older) protocol.
OpenSSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure (SSL alert number 40)
The server aborted the handshake with alert 40 — no acceptable parameters (cipher, signature algorithm, client certificate or SNI…
OpenSSL/Nginx/Apache: error:0909006C:PEM routines:get_name:no start line / unable to load Private Key
The server or tool cannot read the private key file — wrong format, encrypted with a passphrase, wrong path, or a certificate pas…
Two steps away (35)
Cloudflare Error 526: Invalid SSL Certificate
With SSL mode Full (strict), the origin’s certificate is expired, self-signed, or doesn’t match the hostname.
Provisioning profile "x" doesn't include signing certificate "Apple Development: Name (ID)"
The profile was created with a different certificate than the one installed in your keychain.
Nginx: nginx: [emerg] unknown directive "x" in /etc/nginx/sites-enabled/x:12 — configuration file test failed
Nginx found a directive it doesn’t know — a typo, a missing semicolon on the previous line, a directive from a module that isn’t…
npm ERR! code ELIFECYCLE / Command failed with exit code 1
An npm script (build, start, test, postinstall) exited with an error. ELIFECYCLE is only the wrapper — the real error is printed…
gyp ERR! build error / node-gyp rebuild failed
A dependency with native C/C++ code couldn’t compile — missing build tools, Python, or an unsupported Node version.
COPY failed: file not found in build context / "/app/x": not found
The Dockerfile COPY refers to a path outside the build context, excluded by .dockerignore, or relative to the wrong directory.
android.os.NetworkOnMainThreadException
The app made a network call on the main (UI) thread, which Android forbids.
Error Domain=NSURLErrorDomain Code=-1009 "The Internet connection appears to be offline."
URLSession couldn’t reach the network — the device is offline, the app’s cellular data is disabled, or the simulator lost network…
Error Domain=NSURLErrorDomain Code=-1001 "The request timed out."
The server didn’t respond within URLSession’s timeout (60 s default) — slow server, unreachable host on this network, or a stalle…
npm ERR! code SELF_SIGNED_CERT_IN_CHAIN — request to https://registry.npmjs.org/ failed, reason: self signed certificate in certificate chain
A corporate proxy or antivirus is intercepting HTTPS, and npm doesn’t trust its certificate.
Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty
Apache cannot find the certificate or key file named in its configuration, or `SSLEngine on` is set without any certificate.
SSL Labs: Chain issues: Incomplete — Extra download (intermediate certificate missing)
The server sends only its own certificate and not the intermediate CA(s), so some clients cannot build a trusted chain.
Node/OpenSSL: Error: self signed certificate (code: DEPTH_ZERO_SELF_SIGNED_CERT)
The server presented a self-signed certificate (issuer equals subject), which no CA vouches for.
curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com'
The certificate's names (SANs) don't include the host curl connected to.
Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem)
The ACME validation server could not reach your server on port 80 within the timeout.
curl (Windows Schannel): schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate
Windows could not contact the CA's CRL/OCSP servers to check whether the certificate is revoked, so Schannel aborted.
Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name
Apache's SSL virtual host name does not match any name inside the certificate it loads.
NET::ERR_CERT_DATE_INVALID (certificate expired)
The site’s certificate has expired (or isn’t valid yet) — or the device clock is wrong.
Firefox: Peer's Certificate has expired. Error code: SEC_ERROR_EXPIRED_CERTIFICATE
Firefox found an expired certificate in the chain presented by the server.
Let's Encrypt: urn:ietf:params:acme:error:rateLimited :: too many certificates (5) already issued for this exact set of identifiers in the last 168 hours
You hit a Let's Encrypt rate limit — too many certificates, failed validations or new orders in a period.
OpenSSL: verify error:num=10:certificate has expired — notAfter=Jan 1 00:00:00 2025 GMT
OpenSSL's verification found a certificate in the chain whose validity period has ended.
OpenSSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number
The peer did not answer with a TLS record — you spoke TLS to a plain HTTP/SMTP port (or the reverse), or a proxy intervened.
Nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/ssl/server.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)
The private key does not belong to the certificate configured in the server.
Go: cannot assign to struct field users["bob"].Age in map
Map values are not addressable, so you cannot modify a field of a struct stored directly in a map.
Go: assignment mismatch: 1 variable but os.Open returns 2 values
The number of variables on the left does not match the number of values the function returns.
Go: cannot find package "github.com/pkg/errors" in any of: /usr/local/go/src/github.com/pkg/errors (from $GOROOT) /go/src/github.com/pkg/errors (from $GOPATH)
Go could not locate an imported package — it is not downloaded, the module is not initialised, or GOPATH mode is in effect.
Chrome: This site can’t provide a secure connection — uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH
The browser and the server could not agree on a TLS version or cipher — the server is too old or misconfigured, or the browser is.
Chrome: Connection not secure — ERR_SSL_OBSOLETE_VERSION (old TLS 1.0/1.1)
The server only supports an outdated TLS version that current browsers no longer allow.
Java: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
The server rejected the Java client's TLS offer — no shared protocol/cipher, SNI issue or a required client certificate.
cURL error 35: OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to host:443
The TLS handshake failed — protocol/cipher mismatch, a proxy interfering, or the server closed the connection.
Firefox: Secure Connection Failed — SSL_ERROR_NO_CYPHER_OVERLAP (no common cipher)
Firefox and the server share no TLS cipher suite, so the secure handshake cannot even start.
OpenSSL: SSL alert number 112 — tlsv1 unrecognized name
The server did not recognise the hostname sent in SNI and rejected the handshake (or an alert/warning is logged).
OpenSSL: Error outputting keys and certificates — Mac verify error: invalid password?
A `.p12`/`.pfx` file could not be opened because the password is wrong, or its encryption is unsupported by your OpenSSL version.
Java keytool: java.io.IOException: Keystore was tampered with, or password was incorrect
keytool or the JVM could not open the keystore — wrong password, wrong file type, or damaged file.
Windows/IIS: A specified logon session does not exist / The certificate does not have a private key associated with it
IIS cannot bind an HTTPS site because the imported certificate has no private key attached.
Map another error
Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError