Error map

certificate does not have a private key (IIS) Windows/IIS: A specified logon session does not exist / The certificate does not have a private key associated with it

SSL / TLS · layer 2, Network

Open the full error page →

Centre: this error. First ring: errors it is linked with (7). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.

2 · Network 3 · Edge & web server 4 · Application & API 6 · Platform & cloud
certificate does not have a private key (IIS) — Windows/IIS: A specified logon session does not exist / The certificate does not have a private key associated with it (SSL / TLS)certificate…SSLCertificateFile: file does not exist — Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty (SSL / TLS)SSLCertificateFile:…unable to load Private Key — OpenSSL/Nginx/Apache: error:0909006C:PEM routines:get_name:no start line / unable to load Private Key (SSL / TLS)unable to load Priv…AH01909: server certificate does NOT include an ID which matches the server name — Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name (SSL / TLS)AH01909: server cer…PKCS12: Mac verify error: invalid password? — OpenSSL: Error outputting keys and certificates — Mac verify error: invalid password? (SSL / TLS)PKCS12: Mac verify …Timeout during connect (likely firewall problem) — Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem) (SSL / TLS)Timeout during conn…Could not establish trust relationship for the SSL/TLS secure channel — .NET: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel (SSL / TLS)Could not establish…CRYPT_E_NO_REVOCATION_CHECK — curl (Windows Schannel): schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate (SSL / TLS)CRYPT_E_NO_REVOCATI…ERR_TOO_MANY_REDIRECTS (Cloudflare) — ERR_TOO_MANY_REDIRECTS with Cloudflare (Flexible SSL redirect loop) (Cloudflare)ERR_TOO_MANY_REDIRE…ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Cloudflare) — ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain) (Cloudflare)ERR_SSL_VERSION_OR_…Cloudflare Origin CA not trusted — NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied) (Cloudflare)Cloudflare Origin C…no start line — OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch) (SSL / TLS)no start lineunable to get local issuer certificate — OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED (SSL / TLS)unable to get local…verify error:num=10: certificate has expired — OpenSSL: verify error:num=10:certificate has expired — notAfter=Jan 1 00:00:00 2025 GMT (SSL / TLS)verify error:num=10…AH00558 — Apache: AH00558: apache2: Could not reliably determine the server's fully qualified domain name (Nginx / Apache)AH00558SEC_ERROR_EXPIRED_CERTIFICATE — Firefox: Peer's Certificate has expired. Error code: SEC_ERROR_EXPIRED_CERTIFICATE (SSL / TLS)SEC_ERROR_EXPIRED_C…SSL_ERROR_BAD_CERT_DOMAIN — Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN (SSL / TLS)SSL_ERROR_BAD_CERT_…ERR_OSSL_EVP_UNSUPPORTED — Error: error:0308010C:digital envelope routines::unsupported (Node.js)ERR_OSSL_EVP_UNSUPP…SSL routines: wrong version number — OpenSSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (SSL / TLS)SSL routines: wrong…Keystore was tampered with, or password was incorrect — Java keytool: java.io.IOException: Keystore was tampered with, or password was incorrect (SSL / TLS)Keystore was tamper…1020 — Cloudflare Error 1020: Access Denied (Cloudflare)1020ssh port 22 Connection timed out — ssh: connect to host x port 22: Connection timed out (Linux)ssh port 22 Connect…No route to host — connect: No route to host (EHOSTUNREACH) (Linux)No route to hostPKIX path building failed — javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target (Java)PKIX path building …curl: (60) SSL certificate problem — curl: (60) SSL certificate problem: unable to get local issuer certificate (SSL / TLS)curl: (60) SSL cert…no alternative certificate subject name matches target host name — curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com' (SSL / TLS)no alternative cert…error setting certificate verify locations — curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none (SSL / TLS)error setting certi…

Directly related (7)

SSLCertificateFile: file does not existSSL / TLS

Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty

Apache cannot find the certificate or key file named in its configuration, or `SSLEngine on` is set without any certificate.

unable to load Private KeySSL / TLS

OpenSSL/Nginx/Apache: error:0909006C:PEM routines:get_name:no start line / unable to load Private Key

The server or tool cannot read the private key file — wrong format, encrypted with a passphrase, wrong path, or a certificate pas…

AH01909: server certificate does NOT include an ID which matches the server nameSSL / TLS

Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name

Apache's SSL virtual host name does not match any name inside the certificate it loads.

PKCS12: Mac verify error: invalid password?SSL / TLS

OpenSSL: Error outputting keys and certificates — Mac verify error: invalid password?

A `.p12`/`.pfx` file could not be opened because the password is wrong, or its encryption is unsupported by your OpenSSL version.

Timeout during connect (likely firewall problem)SSL / TLS

Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem)

The ACME validation server could not reach your server on port 80 within the timeout.

Could not establish trust relationship for the SSL/TLS secure channelSSL / TLS

.NET: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel

A .NET client could not validate the server certificate or negotiate TLS, so the HTTPS call failed.

CRYPT_E_NO_REVOCATION_CHECKSSL / TLS

curl (Windows Schannel): schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate

Windows could not contact the CA's CRL/OCSP servers to check whether the certificate is revoked, so Schannel aborted.

Two steps away (19)

ERR_TOO_MANY_REDIRECTS (Cloudflare)Cloudflare

ERR_TOO_MANY_REDIRECTS with Cloudflare (Flexible SSL redirect loop)

The page redirects to itself forever — classic cause: Cloudflare SSL mode “Flexible” while the origin redirects HTTP to HTTPS.

ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Cloudflare)Cloudflare

ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain)

Cloudflare has no edge certificate for the hostname — the Universal SSL cert is still pending, or the hostname is a second-level…

Cloudflare Origin CA not trustedCloudflare

NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied)

Cloudflare Origin CA certificates are only trusted by Cloudflare — visitors reaching the origin directly (grey-cloud record, dire…

no start lineSSL / TLS

OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch)

OpenSSL (or Nginx/Apache) couldn’t read the certificate or key — wrong file format, wrong file, or the key doesn’t match the cert…

unable to get local issuer certificateSSL / TLS

OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED

The client could not build a chain from the server's certificate to a CA it trusts — the issuer is missing locally or the server…

verify error:num=10: certificate has expiredSSL / TLS

OpenSSL: verify error:num=10:certificate has expired — notAfter=Jan 1 00:00:00 2025 GMT

OpenSSL's verification found a certificate in the chain whose validity period has ended.

AH00558Nginx / Apache

Apache: AH00558: apache2: Could not reliably determine the server's fully qualified domain name

A harmless startup warning: Apache has no global ServerName, so it guessed one from the host’s IP.

SEC_ERROR_EXPIRED_CERTIFICATESSL / TLS

Firefox: Peer's Certificate has expired. Error code: SEC_ERROR_EXPIRED_CERTIFICATE

Firefox found an expired certificate in the chain presented by the server.

SSL_ERROR_BAD_CERT_DOMAINSSL / TLS

Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN

The certificate does not include the hostname you typed.

ERR_OSSL_EVP_UNSUPPORTEDNode.js

Error: error:0308010C:digital envelope routines::unsupported

An old build tool (webpack 4, old react-scripts) uses a hash algorithm that OpenSSL 3 in Node 17+ disables.

SSL routines: wrong version numberSSL / TLS

OpenSSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number

The peer did not answer with a TLS record — you spoke TLS to a plain HTTP/SMTP port (or the reverse), or a proxy intervened.

Keystore was tampered with, or password was incorrectSSL / TLS

Java keytool: java.io.IOException: Keystore was tampered with, or password was incorrect

keytool or the JVM could not open the keystore — wrong password, wrong file type, or damaged file.

1020Cloudflare

Cloudflare Error 1020: Access Denied

A Cloudflare firewall/WAF custom rule blocked the request — the visitor’s IP, country, user agent or request pattern matched a bl…

ssh port 22 Connection timed outLinux

ssh: connect to host x port 22: Connection timed out

SSH packets get no reply — a firewall/security group drops them, the server is off, or the IP is wrong.

No route to hostLinux

connect: No route to host (EHOSTUNREACH)

The destination host isn’t reachable — it’s down, on another subnet without routing, or a firewall rejects with “host unreachable…

PKIX path building failedJava

javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target

Java doesn’t trust the server’s certificate chain (self-signed, corporate proxy CA, or missing intermediate).

curl: (60) SSL certificate problemSSL / TLS

curl: (60) SSL certificate problem: unable to get local issuer certificate

curl could not verify the server's certificate — missing CA, incomplete chain, self-signed or expired certificate.

no alternative certificate subject name matches target host nameSSL / TLS

curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com'

The certificate's names (SANs) don't include the host curl connected to.

error setting certificate verify locationsSSL / TLS

curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none

curl cannot read the CA bundle file it is configured to use — missing file, wrong path or permissions.

Map another error

Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError