Error map
sslv3 alert handshake failure OpenSSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure (SSL alert number 40)
SSL / TLS · layer 2, Network
Centre: this error. First ring: errors it is linked with (10). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (10)
cURL error 35: OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to host:443
The TLS handshake failed — protocol/cipher mismatch, a proxy interfering, or the server closed the connection.
Firefox: Secure Connection Failed — SSL_ERROR_NO_CYPHER_OVERLAP (no common cipher)
Firefox and the server share no TLS cipher suite, so the secure handshake cannot even start.
OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED
The client could not build a chain from the server's certificate to a CA it trusts — the issuer is missing locally or the server…
Java: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
The server rejected the Java client's TLS offer — no shared protocol/cipher, SNI issue or a required client certificate.
OpenSSL: error:0A00018E:SSL routines::ca md too weak / error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small
OpenSSL's security level rejected a certificate signed with a weak hash (MD5/SHA-1) or with a small key (RSA < 2048).
OpenSSL: error:14094410 / SSL alert number 70 — tlsv1 alert protocol version
The server rejected the TLS version your client offered, because it requires a newer (or older) protocol.
gRPC: rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: x509: certificate signed by unknown authority"
A gRPC client could not complete TLS to the server — untrusted certificate, name mismatch, or plaintext/TLS mismatch.
OpenSSL: SSL alert number 112 — tlsv1 unrecognized name
The server did not recognise the hostname sent in SNI and rejected the handshake (or an alert/warning is logged).
Python: ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:2396)
The server closed the TLS connection abruptly without a proper shutdown, usually because it rejected the handshake or dropped the…
Chrome: ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY — HTTP/2 requires a modern TLS cipher
The server speaks HTTP/2 but negotiated a TLS version or cipher that HTTP/2 forbids (blocklisted ciphers or TLS below 1.2).
Two steps away (26)
SSL: CERTIFICATE_VERIFY_FAILED / unable to get local issuer certificate
The client couldn’t verify the server’s TLS certificate chain, so it refused the HTTPS connection.
fatal: unable to access 'https://…': SSL certificate problem: unable to get local issuer certificate
Git doesn’t trust the HTTPS server’s certificate — corporate proxy, self-hosted Git with an internal CA, or outdated CA bundle.
javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target
Java doesn’t trust the server’s certificate chain (self-signed, corporate proxy CA, or missing intermediate).
ERR_SSL_PROTOCOL_ERROR (This site can't provide a secure connection)
The browser couldn’t negotiate TLS — the server sent an invalid response, often plain HTTP on the HTTPS port.
Chrome: This site can’t be reached — example.com unexpectedly closed the connection. ERR_CONNECTION_CLOSED
The server closed the connection before finishing the TLS handshake or sending a response — typical for HTTP/HTTPS port mix-ups,…
Chrome: This site can’t provide a secure connection — uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH
The browser and the server could not agree on a TLS version or cipher — the server is too old or misconfigured, or the browser is.
Error: error:0308010C:digital envelope routines::unsupported
An old build tool (webpack 4, old react-scripts) uses a hash algorithm that OpenSSL 3 in Node 17+ disables.
OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch)
OpenSSL (or Nginx/Apache) couldn’t read the certificate or key — wrong file format, wrong file, or the key doesn’t match the cert…
Dart: HandshakeException: Handshake error in client (OS Error: CERTIFICATE_VERIFY_FAILED: unable to get local issuer certificate)
The app refused the server's TLS certificate because it is self-signed, expired, missing intermediates, or the device clock/CA st…
Java: javax.net.ssl.SSLHandshakeException: No subject alternative names matching IP address 10.0.0.5 found
Java checks the hostname against the certificate's SANs and found no matching entry (for DNS names or IPs).
Java keytool: java.io.IOException: Keystore was tampered with, or password was incorrect
keytool or the JVM could not open the keystore — wrong password, wrong file type, or damaged file.
OpenSSL: verify error:num=10:certificate has expired — notAfter=Jan 1 00:00:00 2025 GMT
OpenSSL's verification found a certificate in the chain whose validity period has ended.
OpenSSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number
The peer did not answer with a TLS record — you spoke TLS to a plain HTTP/SMTP port (or the reverse), or a proxy intervened.
OpenSSL/Nginx/Apache: error:0909006C:PEM routines:get_name:no start line / unable to load Private Key
The server or tool cannot read the private key file — wrong format, encrypted with a passphrase, wrong path, or a certificate pas…
Chrome: Connection not secure — ERR_SSL_OBSOLETE_VERSION (old TLS 1.0/1.1)
The server only supports an outdated TLS version that current browsers no longer allow.
Firefox: Secure Connection Failed — SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG
Firefox sent a TLS handshake but received plain HTTP back — you used `https://` on a port that serves HTTP.
Go: x509: certificate signed by unknown authority
The Go TLS client does not trust the CA that signed the server's certificate.
Go: x509: certificate is valid for www.example.com, not api.example.com
The server's certificate does not list the hostname you connected to (SAN mismatch), or it has expired.
Android/OkHttp: javax.net.ssl.SSLPeerUnverifiedException: Certificate pinning failure! Peer certificate chain: sha256/... Pinned certificates for api.example.com
The app's pinned certificate/public-key hash does not match the one the server presented, so OkHttp blocked the request.
Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN
The certificate does not include the hostname you typed.
Nginx: [emerg] no "ssl_certificate" is defined for the "listen ... ssl" directive in /etc/nginx/sites-enabled/default:3
A server block listens with `ssl` but has no `ssl_certificate` and `ssl_certificate_key`.
Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem)
The ACME validation server could not reach your server on port 80 within the timeout.
Python requests: HTTPSConnectionPool(host='api.example.com', port=443): Max retries exceeded with url: /v1 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] ...')))
The `requests` call failed during the TLS step and exhausted its retries; the real reason is in the nested SSLError text.
Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty
Apache cannot find the certificate or key file named in its configuration, or `SSLEngine on` is set without any certificate.
Let's Encrypt/CA: CAA record for example.com prevents issuance
The domain's DNS CAA records do not list the certificate authority you asked, so the CA must refuse.
Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name
Apache's SSL virtual host name does not match any name inside the certificate it loads.
Map another error
Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError