Error map

ERR_SSL_KEY_USAGE_INCOMPATIBLE Chrome: ERR_SSL_KEY_USAGE_INCOMPATIBLE — the certificate's key usage doesn't allow the negotiated cipher

SSL / TLS · layer 2, Network

Open the full error page →

Centre: this error. First ring: errors it is linked with (7). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.

1 · On your device 2 · Network 3 · Edge & web server 4 · Application & API 6 · Platform & cloud
ERR_SSL_KEY_USAGE_INCOMPATIBLE — Chrome: ERR_SSL_KEY_USAGE_INCOMPATIBLE — the certificate's key usage doesn't allow the negotiated cipher (SSL / TLS)ERR_SSL_KEY…SSLCertificateFile: file does not exist — Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty (SSL / TLS)SSLCertificateFile:…ca md too weak / ee key too small — OpenSSL: error:0A00018E:SSL routines::ca md too weak / error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small (SSL / TLS)ca md too weak / ee…SSL_CTX_use_PrivateKey_file failed (key values mismatch) — Nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/ssl/server.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch) (SSL / TLS)SSL_CTX_use_Private…Timeout during connect (likely firewall problem) — Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem) (SSL / TLS)Timeout during conn…CAA record forbids issuance — Let's Encrypt/CA: CAA record for example.com prevents issuance (SSL / TLS)CAA record forbids …ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY — Chrome: ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY — HTTP/2 requires a modern TLS cipher (SSL / TLS)ERR_HTTP2_INADEQUAT…AH01909: server certificate does NOT include an ID which matches the server name — Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name (SSL / TLS)AH01909: server cer…ERR_TOO_MANY_REDIRECTS (Cloudflare) — ERR_TOO_MANY_REDIRECTS with Cloudflare (Flexible SSL redirect loop) (Cloudflare)ERR_TOO_MANY_REDIRE…ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Cloudflare) — ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain) (Cloudflare)ERR_SSL_VERSION_OR_…Cloudflare Origin CA not trusted — NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied) (Cloudflare)Cloudflare Origin C…ERR_OSSL_EVP_UNSUPPORTED — Error: error:0308010C:digital envelope routines::unsupported (Node.js)ERR_OSSL_EVP_UNSUPP…no start line — OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch) (SSL / TLS)no start lineunable to get local issuer certificate — OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED (SSL / TLS)unable to get local…bind() failed (98: Address already in use) — nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use) (Linux)bind() failed (98: …upstream timed out — Nginx: upstream timed out (110: Connection timed out) while reading response header from upstream (Nginx / Apache)upstream timed outnginx: [emerg] unknown directive — Nginx: nginx: [emerg] unknown directive "x" in /etc/nginx/sites-enabled/x:12 — configuration file test failed (Nginx / Apache)nginx: [emerg] unkn…1020 — Cloudflare Error 1020: Access Denied (Cloudflare)1020ssh port 22 Connection timed out — ssh: connect to host x port 22: Connection timed out (Linux)ssh port 22 Connect…No route to host — connect: No route to host (EHOSTUNREACH) (Linux)No route to hostsudo: unable to resolve host — sudo: unable to resolve host <hostname>: Name or service not known (Linux)sudo: unable to res…Temporary failure in name resolution — ping: google.com: Temporary failure in name resolution (Linux)Temporary failure i…523 — Cloudflare Error 523: Origin is unreachable (Cloudflare)523ERR_SSL_VERSION_OR_CIPHER_MISMATCH — Chrome: This site can’t provide a secure connection — uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Browser)ERR_SSL_VERSION_OR_…sslv3 alert handshake failure — OpenSSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure (SSL alert number 40) (SSL / TLS)sslv3 alert handsha…no "ssl_certificate" is defined for the "listen ... ssl" directive — Nginx: [emerg] no "ssl_certificate" is defined for the "listen ... ssl" directive in /etc/nginx/sites-enabled/default:3 (SSL / TLS)no "ssl_certificate…AH00558 — Apache: AH00558: apache2: Could not reliably determine the server's fully qualified domain name (Nginx / Apache)AH00558SEC_ERROR_EXPIRED_CERTIFICATE — Firefox: Peer's Certificate has expired. Error code: SEC_ERROR_EXPIRED_CERTIFICATE (SSL / TLS)SEC_ERROR_EXPIRED_C…SSL_ERROR_BAD_CERT_DOMAIN — Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN (SSL / TLS)SSL_ERROR_BAD_CERT_…

Directly related (7)

SSLCertificateFile: file does not existSSL / TLS

Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty

Apache cannot find the certificate or key file named in its configuration, or `SSLEngine on` is set without any certificate.

ca md too weak / ee key too smallSSL / TLS

OpenSSL: error:0A00018E:SSL routines::ca md too weak / error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small

OpenSSL's security level rejected a certificate signed with a weak hash (MD5/SHA-1) or with a small key (RSA < 2048).

SSL_CTX_use_PrivateKey_file failed (key values mismatch)SSL / TLS

Nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/ssl/server.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)

The private key does not belong to the certificate configured in the server.

Timeout during connect (likely firewall problem)SSL / TLS

Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem)

The ACME validation server could not reach your server on port 80 within the timeout.

CAA record forbids issuanceSSL / TLS

Let's Encrypt/CA: CAA record for example.com prevents issuance

The domain's DNS CAA records do not list the certificate authority you asked, so the CA must refuse.

ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITYSSL / TLS

Chrome: ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY — HTTP/2 requires a modern TLS cipher

The server speaks HTTP/2 but negotiated a TLS version or cipher that HTTP/2 forbids (blocklisted ciphers or TLS below 1.2).

AH01909: server certificate does NOT include an ID which matches the server nameSSL / TLS

Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name

Apache's SSL virtual host name does not match any name inside the certificate it loads.

Two steps away (21)

ERR_TOO_MANY_REDIRECTS (Cloudflare)Cloudflare

ERR_TOO_MANY_REDIRECTS with Cloudflare (Flexible SSL redirect loop)

The page redirects to itself forever — classic cause: Cloudflare SSL mode “Flexible” while the origin redirects HTTP to HTTPS.

ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Cloudflare)Cloudflare

ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain)

Cloudflare has no edge certificate for the hostname — the Universal SSL cert is still pending, or the hostname is a second-level…

Cloudflare Origin CA not trustedCloudflare

NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied)

Cloudflare Origin CA certificates are only trusted by Cloudflare — visitors reaching the origin directly (grey-cloud record, dire…

ERR_OSSL_EVP_UNSUPPORTEDNode.js

Error: error:0308010C:digital envelope routines::unsupported

An old build tool (webpack 4, old react-scripts) uses a hash algorithm that OpenSSL 3 in Node 17+ disables.

no start lineSSL / TLS

OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch)

OpenSSL (or Nginx/Apache) couldn’t read the certificate or key — wrong file format, wrong file, or the key doesn’t match the cert…

unable to get local issuer certificateSSL / TLS

OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED

The client could not build a chain from the server's certificate to a CA it trusts — the issuer is missing locally or the server…

bind() failed (98: Address already in use)Linux

nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)

Nginx (or another server) can’t listen on the port because another process already holds it — often Apache, another Nginx, or a s…

upstream timed outNginx / Apache

Nginx: upstream timed out (110: Connection timed out) while reading response header from upstream

Nginx waited longer than proxy_read_timeout (60 s default) for the backend (app server, PHP-FPM) to respond, then returned 504.

nginx: [emerg] unknown directiveNginx / Apache

Nginx: nginx: [emerg] unknown directive "x" in /etc/nginx/sites-enabled/x:12 — configuration file test failed

Nginx found a directive it doesn’t know — a typo, a missing semicolon on the previous line, a directive from a module that isn’t…

1020Cloudflare

Cloudflare Error 1020: Access Denied

A Cloudflare firewall/WAF custom rule blocked the request — the visitor’s IP, country, user agent or request pattern matched a bl…

ssh port 22 Connection timed outLinux

ssh: connect to host x port 22: Connection timed out

SSH packets get no reply — a firewall/security group drops them, the server is off, or the IP is wrong.

No route to hostLinux

connect: No route to host (EHOSTUNREACH)

The destination host isn’t reachable — it’s down, on another subnet without routing, or a firewall rejects with “host unreachable…

sudo: unable to resolve hostLinux

sudo: unable to resolve host <hostname>: Name or service not known

The machine’s hostname isn’t in /etc/hosts (or DNS), so sudo prints this warning — usually after changing the hostname.

Temporary failure in name resolutionLinux

ping: google.com: Temporary failure in name resolution

The Linux host can’t resolve domain names — no working DNS server is configured or reachable.

523Cloudflare

Cloudflare Error 523: Origin is unreachable

Cloudflare can’t find a network route to your origin server — the DNS record points to a wrong/unroutable IP or the origin networ…

ERR_SSL_VERSION_OR_CIPHER_MISMATCHBrowser

Chrome: This site can’t provide a secure connection — uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH

The browser and the server could not agree on a TLS version or cipher — the server is too old or misconfigured, or the browser is.

sslv3 alert handshake failureSSL / TLS

OpenSSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure (SSL alert number 40)

The server aborted the handshake with alert 40 — no acceptable parameters (cipher, signature algorithm, client certificate or SNI…

no "ssl_certificate" is defined for the "listen ... ssl" directiveSSL / TLS

Nginx: [emerg] no "ssl_certificate" is defined for the "listen ... ssl" directive in /etc/nginx/sites-enabled/default:3

A server block listens with `ssl` but has no `ssl_certificate` and `ssl_certificate_key`.

AH00558Nginx / Apache

Apache: AH00558: apache2: Could not reliably determine the server's fully qualified domain name

A harmless startup warning: Apache has no global ServerName, so it guessed one from the host’s IP.

SEC_ERROR_EXPIRED_CERTIFICATESSL / TLS

Firefox: Peer's Certificate has expired. Error code: SEC_ERROR_EXPIRED_CERTIFICATE

Firefox found an expired certificate in the chain presented by the server.

SSL_ERROR_BAD_CERT_DOMAINSSL / TLS

Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN

The certificate does not include the hostname you typed.

Map another error

Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError