Error map
SSL_CTX_set_tmp_dh failed: dh key too small Nginx: [emerg] SSL_CTX_set_tmp_dh("/etc/ssl/dhparam.pem") failed (SSL: error:1401E0A8:SSL routines:... dh key too small)
SSL / TLS · layer 2, Network
Centre: this error. First ring: errors it is linked with (9). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (9)
Nginx: upstream timed out (110: Connection timed out) while reading response header from upstream
Nginx waited longer than proxy_read_timeout (60 s default) for the backend (app server, PHP-FPM) to respond, then returned 504.
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
Nginx (or another server) can’t listen on the port because another process already holds it — often Apache, another Nginx, or a s…
OpenSSL: error:0A00018E:SSL routines::ca md too weak / error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small
OpenSSL's security level rejected a certificate signed with a weak hash (MD5/SHA-1) or with a small key (RSA < 2048).
Nginx: [emerg] no "ssl_certificate" is defined for the "listen ... ssl" directive in /etc/nginx/sites-enabled/default:3
A server block listens with `ssl` but has no `ssl_certificate` and `ssl_certificate_key`.
Nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/etc/ssl/cert.pem"
OCSP stapling is enabled but the certificate (or chain file) contains no OCSP responder, so nginx can't staple a response.
Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name
Apache's SSL virtual host name does not match any name inside the certificate it loads.
Nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/ssl/server.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch)
The private key does not belong to the certificate configured in the server.
Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem)
The ACME validation server could not reach your server on port 80 within the timeout.
Certbot: Could not automatically find a matching server block for example.com. Set the `server_name` directive to use the Nginx installer
Certbot's Nginx plugin could not find a `server` block whose `server_name` matches the domain you requested.
Two steps away (27)
MySQL ERROR 2006 (HY000): MySQL server has gone away
The connection to MySQL was closed — usually by a timeout or a packet larger than `max_allowed_packet`.
HTTP 408 Request Timeout
The server closed the connection because the client took too long to send the complete request.
HTTP 502 Bad Gateway
A proxy or gateway (Nginx, load balancer, CDN) got an invalid response — or no response — from the upstream server behind it.
Error: listen EADDRINUSE: address already in use :::3000
Another process is already listening on that port.
Docker: Bind for 0.0.0.0:80 failed: port is already allocated
Another container or host process already publishes that host port.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
Error: error:0308010C:digital envelope routines::unsupported
An old build tool (webpack 4, old react-scripts) uses a hash algorithm that OpenSSL 3 in Node 17+ disables.
OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch)
OpenSSL (or Nginx/Apache) couldn’t read the certificate or key — wrong file format, wrong file, or the key doesn’t match the cert…
OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED
The client could not build a chain from the server's certificate to a CA it trusts — the issuer is missing locally or the server…
ERR_SSL_PROTOCOL_ERROR (This site can't provide a secure connection)
The browser couldn’t negotiate TLS — the server sent an invalid response, often plain HTTP on the HTTPS port.
OpenSSL: SSL alert number 112 — tlsv1 unrecognized name
The server did not recognise the hostname sent in SNI and rejected the handshake (or an alert/warning is logged).
Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty
Apache cannot find the certificate or key file named in its configuration, or `SSLEngine on` is set without any certificate.
Chrome: Your connection is not private — NET::ERR_CERT_REVOKED (the certificate was revoked)
The site’s TLS certificate has been revoked by the certificate authority, so browsers refuse to trust it.
SSL Labs: Chain issues: Incomplete — Extra download (intermediate certificate missing)
The server sends only its own certificate and not the intermediate CA(s), so some clients cannot build a trusted chain.
curl (Windows Schannel): schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate
Windows could not contact the CA's CRL/OCSP servers to check whether the certificate is revoked, so Schannel aborted.
ERR_TOO_MANY_REDIRECTS with Cloudflare (Flexible SSL redirect loop)
The page redirects to itself forever — classic cause: Cloudflare SSL mode “Flexible” while the origin redirects HTTP to HTTPS.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain)
Cloudflare has no edge certificate for the hostname — the Universal SSL cert is still pending, or the hostname is a second-level…
NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied)
Cloudflare Origin CA certificates are only trusted by Cloudflare — visitors reaching the origin directly (grey-cloud record, dire…
Nginx: nginx: [emerg] unknown directive "x" in /etc/nginx/sites-enabled/x:12 — configuration file test failed
Nginx found a directive it doesn’t know — a typo, a missing semicolon on the previous line, a directive from a module that isn’t…
OpenSSL/Nginx/Apache: error:0909006C:PEM routines:get_name:no start line / unable to load Private Key
The server or tool cannot read the private key file — wrong format, encrypted with a passphrase, wrong path, or a certificate pas…
MySQL: ERROR 2026 (HY000): SSL connection error: SSL is required but the server doesn't support it
The client demanded SSL/TLS (`--ssl-mode=REQUIRED`) but the MySQL server has TLS disabled or no certificates configured.
Cloudflare Error 1020: Access Denied
A Cloudflare firewall/WAF custom rule blocked the request — the visitor’s IP, country, user agent or request pattern matched a bl…
ssh: connect to host x port 22: Connection timed out
SSH packets get no reply — a firewall/security group drops them, the server is off, or the IP is wrong.
connect: No route to host (EHOSTUNREACH)
The destination host isn’t reachable — it’s down, on another subnet without routing, or a firewall rejects with “host unreachable…
Let’s Encrypt / Certbot: Challenge failed for domain example.com — Invalid response from http://example.com/.well-known/acme-challenge/x: 404
Let’s Encrypt couldn’t verify you control the domain — the HTTP-01 challenge file wasn’t served, or DNS points elsewhere.
Certbot: Failed to renew certificate example.com with error — The following certs could not be renewed: /etc/letsencrypt/live/example.com/fullchain.pem (failure)
`certbot renew` failed for one or more certificates, so they will expire if you don't fix it.
Certbot: Problem binding to port 80: Could not bind to IPv4 or IPv6 (standalone authenticator)
`certbot --standalone` needs to listen on port 80 for the HTTP-01 challenge but another process (Nginx, Apache) already holds it.
Map another error
Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError