Error map

Could not establish trust relationship for the SSL/TLS secure channel .NET: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel

SSL / TLS · layer 2, Network

Open the full error page →

Centre: this error. First ring: errors it is linked with (7). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.

2 · Network 3 · Edge & web server 4 · Application & API 6 · Platform & cloud 7 · Build & delivery
Could not establish trust relationship for the SSL/TLS secure channel — .NET: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel (SSL / TLS)Could not e…PKIX path building failed — javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target (Java)PKIX path building …SSLCertificateFile: file does not exist — Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty (SSL / TLS)SSLCertificateFile:…certificate does not have a private key (IIS) — Windows/IIS: A specified logon session does not exist / The certificate does not have a private key associated with it (SSL / TLS)certificate does no…AH01909: server certificate does NOT include an ID which matches the server name — Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name (SSL / TLS)AH01909: server cer…SSL_ERROR_BAD_CERT_DOMAIN — Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN (SSL / TLS)SSL_ERROR_BAD_CERT_…Timeout during connect (likely firewall problem) — Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem) (SSL / TLS)Timeout during conn…CRYPT_E_NO_REVOCATION_CHECK — curl (Windows Schannel): schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate (SSL / TLS)CRYPT_E_NO_REVOCATI…OutOfMemoryError — java.lang.OutOfMemoryError: Java heap space (Java)OutOfMemoryErrorCERTIFICATE_VERIFY_FAILED — SSL: CERTIFICATE_VERIFY_FAILED / unable to get local issuer certificate (API)CERTIFICATE_VERIFY_…Git SSL certificate problem — fatal: unable to access 'https://…': SSL certificate problem: unable to get local issuer certificate (Git)Git SSL certificate…ERR_TOO_MANY_REDIRECTS (Cloudflare) — ERR_TOO_MANY_REDIRECTS with Cloudflare (Flexible SSL redirect loop) (Cloudflare)ERR_TOO_MANY_REDIRE…ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Cloudflare) — ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain) (Cloudflare)ERR_SSL_VERSION_OR_…Cloudflare Origin CA not trusted — NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied) (Cloudflare)Cloudflare Origin C…unable to load Private Key — OpenSSL/Nginx/Apache: error:0909006C:PEM routines:get_name:no start line / unable to load Private Key (SSL / TLS)unable to load Priv…PKCS12: Mac verify error: invalid password? — OpenSSL: Error outputting keys and certificates — Mac verify error: invalid password? (SSL / TLS)PKCS12: Mac verify …AH00558 — Apache: AH00558: apache2: Could not reliably determine the server's fully qualified domain name (Nginx / Apache)AH00558SEC_ERROR_EXPIRED_CERTIFICATE — Firefox: Peer's Certificate has expired. Error code: SEC_ERROR_EXPIRED_CERTIFICATE (SSL / TLS)SEC_ERROR_EXPIRED_C…UNABLE_TO_VERIFY_LEAF_SIGNATURE — Node.js: Error: unable to verify the first certificate (code: UNABLE_TO_VERIFY_LEAF_SIGNATURE) (SSL / TLS)UNABLE_TO_VERIFY_LE…NET::ERR_CERT_COMMON_NAME_INVALID — NET::ERR_CERT_COMMON_NAME_INVALID: Your connection is not private (certificate is for a different domain) (SSL / TLS)NET::ERR_CERT_COMMO…no alternative certificate subject name matches target host name — curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com' (SSL / TLS)no alternative cert…tlsv1 unrecognized name (SNI) — OpenSSL: SSL alert number 112 — tlsv1 unrecognized name (SSL / TLS)tlsv1 unrecognized …1020 — Cloudflare Error 1020: Access Denied (Cloudflare)1020ssh port 22 Connection timed out — ssh: connect to host x port 22: Connection timed out (Linux)ssh port 22 Connect…No route to host — connect: No route to host (EHOSTUNREACH) (Linux)No route to hostcurl: (60) SSL certificate problem — curl: (60) SSL certificate problem: unable to get local issuer certificate (SSL / TLS)curl: (60) SSL cert…error setting certificate verify locations — curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none (SSL / TLS)error setting certi…ssl_stapling ignored, no OCSP responder URL — Nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/etc/ssl/cert.pem" (SSL / TLS)ssl_stapling ignore…

Directly related (7)

PKIX path building failedJava

javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target

Java doesn’t trust the server’s certificate chain (self-signed, corporate proxy CA, or missing intermediate).

SSLCertificateFile: file does not existSSL / TLS

Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty

Apache cannot find the certificate or key file named in its configuration, or `SSLEngine on` is set without any certificate.

certificate does not have a private key (IIS)SSL / TLS

Windows/IIS: A specified logon session does not exist / The certificate does not have a private key associated with it

IIS cannot bind an HTTPS site because the imported certificate has no private key attached.

AH01909: server certificate does NOT include an ID which matches the server nameSSL / TLS

Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name

Apache's SSL virtual host name does not match any name inside the certificate it loads.

SSL_ERROR_BAD_CERT_DOMAINSSL / TLS

Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN

The certificate does not include the hostname you typed.

Timeout during connect (likely firewall problem)SSL / TLS

Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem)

The ACME validation server could not reach your server on port 80 within the timeout.

CRYPT_E_NO_REVOCATION_CHECKSSL / TLS

curl (Windows Schannel): schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate

Windows could not contact the CA's CRL/OCSP servers to check whether the certificate is revoked, so Schannel aborted.

Two steps away (20)

OutOfMemoryErrorJava

java.lang.OutOfMemoryError: Java heap space

The JVM ran out of heap memory and garbage collection couldn’t free enough.

CERTIFICATE_VERIFY_FAILEDAPI

SSL: CERTIFICATE_VERIFY_FAILED / unable to get local issuer certificate

The client couldn’t verify the server’s TLS certificate chain, so it refused the HTTPS connection.

Git SSL certificate problemGit

fatal: unable to access 'https://…': SSL certificate problem: unable to get local issuer certificate

Git doesn’t trust the HTTPS server’s certificate — corporate proxy, self-hosted Git with an internal CA, or outdated CA bundle.

ERR_TOO_MANY_REDIRECTS (Cloudflare)Cloudflare

ERR_TOO_MANY_REDIRECTS with Cloudflare (Flexible SSL redirect loop)

The page redirects to itself forever — classic cause: Cloudflare SSL mode “Flexible” while the origin redirects HTTP to HTTPS.

ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Cloudflare)Cloudflare

ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain)

Cloudflare has no edge certificate for the hostname — the Universal SSL cert is still pending, or the hostname is a second-level…

Cloudflare Origin CA not trustedCloudflare

NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied)

Cloudflare Origin CA certificates are only trusted by Cloudflare — visitors reaching the origin directly (grey-cloud record, dire…

unable to load Private KeySSL / TLS

OpenSSL/Nginx/Apache: error:0909006C:PEM routines:get_name:no start line / unable to load Private Key

The server or tool cannot read the private key file — wrong format, encrypted with a passphrase, wrong path, or a certificate pas…

PKCS12: Mac verify error: invalid password?SSL / TLS

OpenSSL: Error outputting keys and certificates — Mac verify error: invalid password?

A `.p12`/`.pfx` file could not be opened because the password is wrong, or its encryption is unsupported by your OpenSSL version.

AH00558Nginx / Apache

Apache: AH00558: apache2: Could not reliably determine the server's fully qualified domain name

A harmless startup warning: Apache has no global ServerName, so it guessed one from the host’s IP.

SEC_ERROR_EXPIRED_CERTIFICATESSL / TLS

Firefox: Peer's Certificate has expired. Error code: SEC_ERROR_EXPIRED_CERTIFICATE

Firefox found an expired certificate in the chain presented by the server.

UNABLE_TO_VERIFY_LEAF_SIGNATURESSL / TLS

Node.js: Error: unable to verify the first certificate (code: UNABLE_TO_VERIFY_LEAF_SIGNATURE)

Node could not verify the server's leaf certificate because the intermediate certificates were not provided by the server.

NET::ERR_CERT_COMMON_NAME_INVALIDSSL / TLS

NET::ERR_CERT_COMMON_NAME_INVALID: Your connection is not private (certificate is for a different domain)

The certificate presented doesn’t include the hostname you visited — e.g. visiting www.example.com with a certificate only for ex…

no alternative certificate subject name matches target host nameSSL / TLS

curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com'

The certificate's names (SANs) don't include the host curl connected to.

tlsv1 unrecognized name (SNI)SSL / TLS

OpenSSL: SSL alert number 112 — tlsv1 unrecognized name

The server did not recognise the hostname sent in SNI and rejected the handshake (or an alert/warning is logged).

1020Cloudflare

Cloudflare Error 1020: Access Denied

A Cloudflare firewall/WAF custom rule blocked the request — the visitor’s IP, country, user agent or request pattern matched a bl…

ssh port 22 Connection timed outLinux

ssh: connect to host x port 22: Connection timed out

SSH packets get no reply — a firewall/security group drops them, the server is off, or the IP is wrong.

No route to hostLinux

connect: No route to host (EHOSTUNREACH)

The destination host isn’t reachable — it’s down, on another subnet without routing, or a firewall rejects with “host unreachable…

curl: (60) SSL certificate problemSSL / TLS

curl: (60) SSL certificate problem: unable to get local issuer certificate

curl could not verify the server's certificate — missing CA, incomplete chain, self-signed or expired certificate.

error setting certificate verify locationsSSL / TLS

curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none

curl cannot read the CA bundle file it is configured to use — missing file, wrong path or permissions.

ssl_stapling ignored, no OCSP responder URLSSL / TLS

Nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/etc/ssl/cert.pem"

OCSP stapling is enabled but the certificate (or chain file) contains no OCSP responder, so nginx can't staple a response.

Map another error

Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError