Error map
wildcard certificate does not cover a.b.example.com Browser: *.example.com certificate does not match a.b.example.com (ERR_CERT_COMMON_NAME_INVALID)
SSL / TLS · layer 2, Network
Centre: this error. First ring: errors it is linked with (9). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (9)
NET::ERR_CERT_COMMON_NAME_INVALID: Your connection is not private (certificate is for a different domain)
The certificate presented doesn’t include the hostname you visited — e.g. visiting www.example.com with a certificate only for ex…
Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty
Apache cannot find the certificate or key file named in its configuration, or `SSLEngine on` is set without any certificate.
Certbot: Detail: DNS problem: NXDOMAIN looking up A for www.example.com - check that a DNS record exists for this domain
Let's Encrypt could not resolve the domain you asked a certificate for; no A/AAAA record exists.
Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name
Apache's SSL virtual host name does not match any name inside the certificate it loads.
Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN
The certificate does not include the hostname you typed.
curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com'
The certificate's names (SANs) don't include the host curl connected to.
Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem)
The ACME validation server could not reach your server on port 80 within the timeout.
Let's Encrypt/CA: CAA record for example.com prevents issuance
The domain's DNS CAA records do not list the certificate authority you asked, so the CA must refuse.
Certbot: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.example.com / Incorrect TXT record
The DNS-01 challenge could not find (or found the wrong) `_acme-challenge` TXT record for the domain, so the wildcard or DNS vali…
Two steps away (27)
Cloudflare Error 526: Invalid SSL Certificate
With SSL mode Full (strict), the origin’s certificate is expired, self-signed, or doesn’t match the hostname.
NET::ERR_CERT_AUTHORITY_INVALID (Your connection is not private)
The site’s certificate isn’t signed by a CA the browser trusts — self-signed, missing intermediates, or intercepted by a proxy.
Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames
The server’s certificate doesn’t cover the hostname you connected to.
ERR_TOO_MANY_REDIRECTS with Cloudflare (Flexible SSL redirect loop)
The page redirects to itself forever — classic cause: Cloudflare SSL mode “Flexible” while the origin redirects HTTP to HTTPS.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain)
Cloudflare has no edge certificate for the hostname — the Universal SSL cert is still pending, or the hostname is a second-level…
NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied)
Cloudflare Origin CA certificates are only trusted by Cloudflare — visitors reaching the origin directly (grey-cloud record, dire…
sudo: unable to resolve host <hostname>: Name or service not known
The machine’s hostname isn’t in /etc/hosts (or DNS), so sudo prints this warning — usually after changing the hostname.
ping: google.com: Temporary failure in name resolution
The Linux host can’t resolve domain names — no working DNS server is configured or reachable.
Cloudflare Error 523: Origin is unreachable
Cloudflare can’t find a network route to your origin server — the DNS record points to a wrong/unroutable IP or the origin networ…
Apache: AH00558: apache2: Could not reliably determine the server's fully qualified domain name
A harmless startup warning: Apache has no global ServerName, so it guessed one from the host’s IP.
Firefox: Peer's Certificate has expired. Error code: SEC_ERROR_EXPIRED_CERTIFICATE
Firefox found an expired certificate in the chain presented by the server.
Node.js: Error: unable to verify the first certificate (code: UNABLE_TO_VERIFY_LEAF_SIGNATURE)
Node could not verify the server's leaf certificate because the intermediate certificates were not provided by the server.
OpenSSL: SSL alert number 112 — tlsv1 unrecognized name
The server did not recognise the hostname sent in SNI and rejected the handshake (or an alert/warning is logged).
Java: javax.net.ssl.SSLHandshakeException: No subject alternative names matching IP address 10.0.0.5 found
Java checks the hostname against the certificate's SANs and found no matching entry (for DNS names or IPs).
.NET: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel
A .NET client could not validate the server certificate or negotiate TLS, so the HTTPS call failed.
curl: (60) SSL certificate problem: unable to get local issuer certificate
curl could not verify the server's certificate — missing CA, incomplete chain, self-signed or expired certificate.
curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none
curl cannot read the CA bundle file it is configured to use — missing file, wrong path or permissions.
curl (Windows Schannel): schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate
Windows could not contact the CA's CRL/OCSP servers to check whether the certificate is revoked, so Schannel aborted.
Cloudflare Error 1020: Access Denied
A Cloudflare firewall/WAF custom rule blocked the request — the visitor’s IP, country, user agent or request pattern matched a bl…
ssh: connect to host x port 22: Connection timed out
SSH packets get no reply — a firewall/security group drops them, the server is off, or the IP is wrong.
connect: No route to host (EHOSTUNREACH)
The destination host isn’t reachable — it’s down, on another subnet without routing, or a firewall rejects with “host unreachable…
Cloudflare HTTP 530 (with Error 1016 Origin DNS error / 1033 tunnel error)
Cloudflare returns 530 together with a 1xxx error; the 1xxx code (usually 1016 or 1033) tells you the real cause.
Cloudflare Error 1000: DNS points to prohibited IP
A proxied DNS record points at a Cloudflare IP address, creating a loop.
Cloudflare Error 1001: DNS resolution error
Cloudflare received the request but the hostname isn’t set up on Cloudflare (or the domain was just added and not active yet).
Certbot: Could not automatically find a matching server block for example.com. Set the `server_name` directive to use the Nginx installer
Certbot's Nginx plugin could not find a `server` block whose `server_name` matches the domain you requested.
Certbot: Problem binding to port 80: Could not bind to IPv4 or IPv6 (standalone authenticator)
`certbot --standalone` needs to listen on port 80 for the HTTP-01 challenge but another process (Nginx, Apache) already holds it.
Certbot: Detail: Invalid response from http://example.com/.well-known/acme-challenge/abc: 404
Let's Encrypt reached your server but the challenge file was not found at `/.well-known/acme-challenge/`, so the web server retur…
Map another error
Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError