Error map

Keystore was tampered with, or password was incorrect Java keytool: java.io.IOException: Keystore was tampered with, or password was incorrect

SSL / TLS · layer 2, Network

Open the full error page →

Centre: this error. First ring: errors it is linked with (7). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.

2 · Network 3 · Edge & web server 4 · Application & API 6 · Platform & cloud 7 · Build & delivery
Keystore was tampered with, or password was incorrect — Java keytool: java.io.IOException: Keystore was tampered with, or password was incorrect (SSL / TLS)Keystore wa…PKIX path building failed — javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target (Java)PKIX path building …Received fatal alert: handshake_failure — Java: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure (SSL / TLS)Received fatal aler…unable to load Private Key — OpenSSL/Nginx/Apache: error:0909006C:PEM routines:get_name:no start line / unable to load Private Key (SSL / TLS)unable to load Priv…AH01909: server certificate does NOT include an ID which matches the server name — Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name (SSL / TLS)AH01909: server cer…PKCS12: Mac verify error: invalid password? — OpenSSL: Error outputting keys and certificates — Mac verify error: invalid password? (SSL / TLS)PKCS12: Mac verify …No subject alternative names present — Java: javax.net.ssl.SSLHandshakeException: No subject alternative names matching IP address 10.0.0.5 found (SSL / TLS)No subject alternat…Timeout during connect (likely firewall problem) — Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem) (SSL / TLS)Timeout during conn…OutOfMemoryError — java.lang.OutOfMemoryError: Java heap space (Java)OutOfMemoryErrorCERTIFICATE_VERIFY_FAILED — SSL: CERTIFICATE_VERIFY_FAILED / unable to get local issuer certificate (API)CERTIFICATE_VERIFY_…Git SSL certificate problem — fatal: unable to access 'https://…': SSL certificate problem: unable to get local issuer certificate (Git)Git SSL certificate…tlsv1 alert protocol version — OpenSSL: error:14094410 / SSL alert number 70 — tlsv1 alert protocol version (SSL / TLS)tlsv1 alert protoco…sslv3 alert handshake failure — OpenSSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure (SSL alert number 40) (SSL / TLS)sslv3 alert handsha…tlsv1 unrecognized name (SNI) — OpenSSL: SSL alert number 112 — tlsv1 unrecognized name (SSL / TLS)tlsv1 unrecognized …no start line — OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch) (SSL / TLS)no start lineunable to get local issuer certificate — OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED (SSL / TLS)unable to get local…verify error:num=10: certificate has expired — OpenSSL: verify error:num=10:certificate has expired — notAfter=Jan 1 00:00:00 2025 GMT (SSL / TLS)verify error:num=10…ERR_TOO_MANY_REDIRECTS (Cloudflare) — ERR_TOO_MANY_REDIRECTS with Cloudflare (Flexible SSL redirect loop) (Cloudflare)ERR_TOO_MANY_REDIRE…ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Cloudflare) — ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain) (Cloudflare)ERR_SSL_VERSION_OR_…Cloudflare Origin CA not trusted — NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied) (Cloudflare)Cloudflare Origin C…ERR_OSSL_EVP_UNSUPPORTED — Error: error:0308010C:digital envelope routines::unsupported (Node.js)ERR_OSSL_EVP_UNSUPP…SSL routines: wrong version number — OpenSSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (SSL / TLS)SSL routines: wrong…ca md too weak / ee key too small — OpenSSL: error:0A00018E:SSL routines::ca md too weak / error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small (SSL / TLS)ca md too weak / ee…SSL_ERROR_BAD_CERT_DOMAIN — Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN (SSL / TLS)SSL_ERROR_BAD_CERT_…no alternative certificate subject name matches target host name — curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com' (SSL / TLS)no alternative cert…1020 — Cloudflare Error 1020: Access Denied (Cloudflare)1020ssh port 22 Connection timed out — ssh: connect to host x port 22: Connection timed out (Linux)ssh port 22 Connect…No route to host — connect: No route to host (EHOSTUNREACH) (Linux)No route to host

Directly related (7)

PKIX path building failedJava

javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target

Java doesn’t trust the server’s certificate chain (self-signed, corporate proxy CA, or missing intermediate).

Received fatal alert: handshake_failureSSL / TLS

Java: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

The server rejected the Java client's TLS offer — no shared protocol/cipher, SNI issue or a required client certificate.

unable to load Private KeySSL / TLS

OpenSSL/Nginx/Apache: error:0909006C:PEM routines:get_name:no start line / unable to load Private Key

The server or tool cannot read the private key file — wrong format, encrypted with a passphrase, wrong path, or a certificate pas…

AH01909: server certificate does NOT include an ID which matches the server nameSSL / TLS

Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name

Apache's SSL virtual host name does not match any name inside the certificate it loads.

PKCS12: Mac verify error: invalid password?SSL / TLS

OpenSSL: Error outputting keys and certificates — Mac verify error: invalid password?

A `.p12`/`.pfx` file could not be opened because the password is wrong, or its encryption is unsupported by your OpenSSL version.

No subject alternative names presentSSL / TLS

Java: javax.net.ssl.SSLHandshakeException: No subject alternative names matching IP address 10.0.0.5 found

Java checks the hostname against the certificate's SANs and found no matching entry (for DNS names or IPs).

Timeout during connect (likely firewall problem)SSL / TLS

Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem)

The ACME validation server could not reach your server on port 80 within the timeout.

Two steps away (20)

OutOfMemoryErrorJava

java.lang.OutOfMemoryError: Java heap space

The JVM ran out of heap memory and garbage collection couldn’t free enough.

CERTIFICATE_VERIFY_FAILEDAPI

SSL: CERTIFICATE_VERIFY_FAILED / unable to get local issuer certificate

The client couldn’t verify the server’s TLS certificate chain, so it refused the HTTPS connection.

Git SSL certificate problemGit

fatal: unable to access 'https://…': SSL certificate problem: unable to get local issuer certificate

Git doesn’t trust the HTTPS server’s certificate — corporate proxy, self-hosted Git with an internal CA, or outdated CA bundle.

tlsv1 alert protocol versionSSL / TLS

OpenSSL: error:14094410 / SSL alert number 70 — tlsv1 alert protocol version

The server rejected the TLS version your client offered, because it requires a newer (or older) protocol.

sslv3 alert handshake failureSSL / TLS

OpenSSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure (SSL alert number 40)

The server aborted the handshake with alert 40 — no acceptable parameters (cipher, signature algorithm, client certificate or SNI…

tlsv1 unrecognized name (SNI)SSL / TLS

OpenSSL: SSL alert number 112 — tlsv1 unrecognized name

The server did not recognise the hostname sent in SNI and rejected the handshake (or an alert/warning is logged).

no start lineSSL / TLS

OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch)

OpenSSL (or Nginx/Apache) couldn’t read the certificate or key — wrong file format, wrong file, or the key doesn’t match the cert…

unable to get local issuer certificateSSL / TLS

OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED

The client could not build a chain from the server's certificate to a CA it trusts — the issuer is missing locally or the server…

verify error:num=10: certificate has expiredSSL / TLS

OpenSSL: verify error:num=10:certificate has expired — notAfter=Jan 1 00:00:00 2025 GMT

OpenSSL's verification found a certificate in the chain whose validity period has ended.

ERR_TOO_MANY_REDIRECTS (Cloudflare)Cloudflare

ERR_TOO_MANY_REDIRECTS with Cloudflare (Flexible SSL redirect loop)

The page redirects to itself forever — classic cause: Cloudflare SSL mode “Flexible” while the origin redirects HTTP to HTTPS.

ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Cloudflare)Cloudflare

ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain)

Cloudflare has no edge certificate for the hostname — the Universal SSL cert is still pending, or the hostname is a second-level…

Cloudflare Origin CA not trustedCloudflare

NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied)

Cloudflare Origin CA certificates are only trusted by Cloudflare — visitors reaching the origin directly (grey-cloud record, dire…

ERR_OSSL_EVP_UNSUPPORTEDNode.js

Error: error:0308010C:digital envelope routines::unsupported

An old build tool (webpack 4, old react-scripts) uses a hash algorithm that OpenSSL 3 in Node 17+ disables.

SSL routines: wrong version numberSSL / TLS

OpenSSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number

The peer did not answer with a TLS record — you spoke TLS to a plain HTTP/SMTP port (or the reverse), or a proxy intervened.

ca md too weak / ee key too smallSSL / TLS

OpenSSL: error:0A00018E:SSL routines::ca md too weak / error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small

OpenSSL's security level rejected a certificate signed with a weak hash (MD5/SHA-1) or with a small key (RSA < 2048).

SSL_ERROR_BAD_CERT_DOMAINSSL / TLS

Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN

The certificate does not include the hostname you typed.

no alternative certificate subject name matches target host nameSSL / TLS

curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com'

The certificate's names (SANs) don't include the host curl connected to.

1020Cloudflare

Cloudflare Error 1020: Access Denied

A Cloudflare firewall/WAF custom rule blocked the request — the visitor’s IP, country, user agent or request pattern matched a bl…

ssh port 22 Connection timed outLinux

ssh: connect to host x port 22: Connection timed out

SSH packets get no reply — a firewall/security group drops them, the server is off, or the IP is wrong.

No route to hostLinux

connect: No route to host (EHOSTUNREACH)

The destination host isn’t reachable — it’s down, on another subnet without routing, or a firewall rejects with “host unreachable…

Map another error

Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError