Error map

Received fatal alert: handshake_failure Java: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

SSL / TLS · layer 2, Network

Open the full error page →

Centre: this error. First ring: errors it is linked with (8). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.

1 · On your device 2 · Network 4 · Application & API 7 · Build & delivery
Received fatal alert: handshake_failure — Java: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure (SSL / TLS)Received fa…PKIX path building failed — javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target (Java)PKIX path building …tlsv1 alert protocol version — OpenSSL: error:14094410 / SSL alert number 70 — tlsv1 alert protocol version (SSL / TLS)tlsv1 alert protoco…sslv3 alert handshake failure — OpenSSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure (SSL alert number 40) (SSL / TLS)sslv3 alert handsha…gRPC: Ssl handshake failed / authentication handshake failed — gRPC: rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: x509: certificate signed by unknown authority" (SSL / TLS)gRPC: Ssl handshake…tlsv1 unrecognized name (SNI) — OpenSSL: SSL alert number 112 — tlsv1 unrecognized name (SSL / TLS)tlsv1 unrecognized …No subject alternative names present — Java: javax.net.ssl.SSLHandshakeException: No subject alternative names matching IP address 10.0.0.5 found (SSL / TLS)No subject alternat…EOF occurred in violation of protocol — Python: ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:2396) (SSL / TLS)EOF occurred in vio…Keystore was tampered with, or password was incorrect — Java keytool: java.io.IOException: Keystore was tampered with, or password was incorrect (SSL / TLS)Keystore was tamper…OutOfMemoryError — java.lang.OutOfMemoryError: Java heap space (Java)OutOfMemoryErrorCERTIFICATE_VERIFY_FAILED — SSL: CERTIFICATE_VERIFY_FAILED / unable to get local issuer certificate (API)CERTIFICATE_VERIFY_…Git SSL certificate problem — fatal: unable to access 'https://…': SSL certificate problem: unable to get local issuer certificate (Git)Git SSL certificate…ERR_SSL_VERSION_OR_CIPHER_MISMATCH — Chrome: This site can’t provide a secure connection — uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Browser)ERR_SSL_VERSION_OR_…ERR_SSL_OBSOLETE_VERSION — Chrome: Connection not secure — ERR_SSL_OBSOLETE_VERSION (old TLS 1.0/1.1) (Browser)ERR_SSL_OBSOLETE_VE…unable to get local issuer certificate — OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED (SSL / TLS)unable to get local…cURL error 35 — cURL error 35: OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to host:443 (PHP)cURL error 35SSL_ERROR_NO_CYPHER_OVERLAP — Firefox: Secure Connection Failed — SSL_ERROR_NO_CYPHER_OVERLAP (no common cipher) (Browser)SSL_ERROR_NO_CYPHER…ca md too weak / ee key too small — OpenSSL: error:0A00018E:SSL routines::ca md too weak / error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small (SSL / TLS)ca md too weak / ee…x509: certificate signed by unknown authority — Go: x509: certificate signed by unknown authority (Go)x509: certificate s…x509: certificate is valid for X, not Y — Go: x509: certificate is valid for www.example.com, not api.example.com (Go)x509: certificate i…SSL routines: wrong version number — OpenSSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (SSL / TLS)SSL routines: wrong…SSL_ERROR_BAD_CERT_DOMAIN — Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN (SSL / TLS)SSL_ERROR_BAD_CERT_…no "ssl_certificate" is defined for the "listen ... ssl" directive — Nginx: [emerg] no "ssl_certificate" is defined for the "listen ... ssl" directive in /etc/nginx/sites-enabled/default:3 (SSL / TLS)no "ssl_certificate…Timeout during connect (likely firewall problem) — Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem) (SSL / TLS)Timeout during conn…no alternative certificate subject name matches target host name — curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com' (SSL / TLS)no alternative cert…AH01909: server certificate does NOT include an ID which matches the server name — Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name (SSL / TLS)AH01909: server cer…HTTPSConnectionPool: Max retries exceeded (SSLError) — Python requests: HTTPSConnectionPool(host='api.example.com', port=443): Max retries exceeded with url: /v1 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] ...'))) (SSL / TLS)HTTPSConnectionPool…unable to load Private Key — OpenSSL/Nginx/Apache: error:0909006C:PEM routines:get_name:no start line / unable to load Private Key (SSL / TLS)unable to load Priv…PKCS12: Mac verify error: invalid password? — OpenSSL: Error outputting keys and certificates — Mac verify error: invalid password? (SSL / TLS)PKCS12: Mac verify …

Directly related (8)

PKIX path building failedJava

javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target

Java doesn’t trust the server’s certificate chain (self-signed, corporate proxy CA, or missing intermediate).

tlsv1 alert protocol versionSSL / TLS

OpenSSL: error:14094410 / SSL alert number 70 — tlsv1 alert protocol version

The server rejected the TLS version your client offered, because it requires a newer (or older) protocol.

sslv3 alert handshake failureSSL / TLS

OpenSSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure (SSL alert number 40)

The server aborted the handshake with alert 40 — no acceptable parameters (cipher, signature algorithm, client certificate or SNI…

gRPC: Ssl handshake failed / authentication handshake failedSSL / TLS

gRPC: rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: x509: certificate signed by unknown authority"

A gRPC client could not complete TLS to the server — untrusted certificate, name mismatch, or plaintext/TLS mismatch.

tlsv1 unrecognized name (SNI)SSL / TLS

OpenSSL: SSL alert number 112 — tlsv1 unrecognized name

The server did not recognise the hostname sent in SNI and rejected the handshake (or an alert/warning is logged).

No subject alternative names presentSSL / TLS

Java: javax.net.ssl.SSLHandshakeException: No subject alternative names matching IP address 10.0.0.5 found

Java checks the hostname against the certificate's SANs and found no matching entry (for DNS names or IPs).

EOF occurred in violation of protocolSSL / TLS

Python: ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:2396)

The server closed the TLS connection abruptly without a proper shutdown, usually because it rejected the handshake or dropped the…

Keystore was tampered with, or password was incorrectSSL / TLS

Java keytool: java.io.IOException: Keystore was tampered with, or password was incorrect

keytool or the JVM could not open the keystore — wrong password, wrong file type, or damaged file.

Two steps away (20)

OutOfMemoryErrorJava

java.lang.OutOfMemoryError: Java heap space

The JVM ran out of heap memory and garbage collection couldn’t free enough.

CERTIFICATE_VERIFY_FAILEDAPI

SSL: CERTIFICATE_VERIFY_FAILED / unable to get local issuer certificate

The client couldn’t verify the server’s TLS certificate chain, so it refused the HTTPS connection.

Git SSL certificate problemGit

fatal: unable to access 'https://…': SSL certificate problem: unable to get local issuer certificate

Git doesn’t trust the HTTPS server’s certificate — corporate proxy, self-hosted Git with an internal CA, or outdated CA bundle.

ERR_SSL_VERSION_OR_CIPHER_MISMATCHBrowser

Chrome: This site can’t provide a secure connection — uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH

The browser and the server could not agree on a TLS version or cipher — the server is too old or misconfigured, or the browser is.

ERR_SSL_OBSOLETE_VERSIONBrowser

Chrome: Connection not secure — ERR_SSL_OBSOLETE_VERSION (old TLS 1.0/1.1)

The server only supports an outdated TLS version that current browsers no longer allow.

unable to get local issuer certificateSSL / TLS

OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED

The client could not build a chain from the server's certificate to a CA it trusts — the issuer is missing locally or the server…

cURL error 35PHP

cURL error 35: OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to host:443

The TLS handshake failed — protocol/cipher mismatch, a proxy interfering, or the server closed the connection.

SSL_ERROR_NO_CYPHER_OVERLAPBrowser

Firefox: Secure Connection Failed — SSL_ERROR_NO_CYPHER_OVERLAP (no common cipher)

Firefox and the server share no TLS cipher suite, so the secure handshake cannot even start.

ca md too weak / ee key too smallSSL / TLS

OpenSSL: error:0A00018E:SSL routines::ca md too weak / error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small

OpenSSL's security level rejected a certificate signed with a weak hash (MD5/SHA-1) or with a small key (RSA < 2048).

x509: certificate signed by unknown authorityGo

Go: x509: certificate signed by unknown authority

The Go TLS client does not trust the CA that signed the server's certificate.

x509: certificate is valid for X, not YGo

Go: x509: certificate is valid for www.example.com, not api.example.com

The server's certificate does not list the hostname you connected to (SAN mismatch), or it has expired.

SSL routines: wrong version numberSSL / TLS

OpenSSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number

The peer did not answer with a TLS record — you spoke TLS to a plain HTTP/SMTP port (or the reverse), or a proxy intervened.

SSL_ERROR_BAD_CERT_DOMAINSSL / TLS

Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN

The certificate does not include the hostname you typed.

no "ssl_certificate" is defined for the "listen ... ssl" directiveSSL / TLS

Nginx: [emerg] no "ssl_certificate" is defined for the "listen ... ssl" directive in /etc/nginx/sites-enabled/default:3

A server block listens with `ssl` but has no `ssl_certificate` and `ssl_certificate_key`.

Timeout during connect (likely firewall problem)SSL / TLS

Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem)

The ACME validation server could not reach your server on port 80 within the timeout.

no alternative certificate subject name matches target host nameSSL / TLS

curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com'

The certificate's names (SANs) don't include the host curl connected to.

AH01909: server certificate does NOT include an ID which matches the server nameSSL / TLS

Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name

Apache's SSL virtual host name does not match any name inside the certificate it loads.

HTTPSConnectionPool: Max retries exceeded (SSLError)SSL / TLS

Python requests: HTTPSConnectionPool(host='api.example.com', port=443): Max retries exceeded with url: /v1 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] ...')))

The `requests` call failed during the TLS step and exhausted its retries; the real reason is in the nested SSLError text.

unable to load Private KeySSL / TLS

OpenSSL/Nginx/Apache: error:0909006C:PEM routines:get_name:no start line / unable to load Private Key

The server or tool cannot read the private key file — wrong format, encrypted with a passphrase, wrong path, or a certificate pas…

PKCS12: Mac verify error: invalid password?SSL / TLS

OpenSSL: Error outputting keys and certificates — Mac verify error: invalid password?

A `.p12`/`.pfx` file could not be opened because the password is wrong, or its encryption is unsupported by your OpenSSL version.

Map another error

Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError