495 SSL Certificate Error (nginx): Client Cert Failed
495 SSL Certificate Error: nginx got your mTLS cert and rejected it — expired, wrong CA, or bad chain. Find why in 3 checks. Free instant check, no sign-up.
DiagnoseSSL/TLS Certificate & HTTPS Guides
Guides for certificate errors, chain and hostname mismatches, expiry, TLS handshake failures, and HSTS. Each guide includes a free SSL check for your host.
SSL/TLS — 66 guides
497 HTTP Request Sent to HTTPS Port (nginx): Fix
497 HTTP Request Sent to HTTPS Port: nginx got plain HTTP on a TLS port. Fix in 3 checks — scheme, proxy, redirect. Free instant check, no sign-up.
DiagnoseCAA Records: Syntax, Examples and 'Prevents Issuance' Fixes
How CAA records limit which CAs can issue for your domain: issue, issuewild and iodef syntax, CA identifiers, parent and CNAME lookups, and issuance fixes.
DiagnoseCafe24 SSL Certificate Error: Why HTTPS Fails
Cafe24 SSL certificate error or HTTPS not working? Check nameserver delegation, issuance readiness, and www coverage. Free instant check, no sign-up.
DiagnoseCertbot challenge failed (http-01 / dns-01)
Certbot 'challenge failed'? Split by type: check port-80 /.well-known for http-01, or the _acme-challenge TXT record for dns-01. Free instant check.
DiagnoseChrome Warns Before HTTP Sites: Check and Fix Yours Now
From Chrome 154 (October 2026) Chrome shows a warning before opening a public site without HTTPS. Who is affected, how to check your sites, and how to fix them.
DiagnoseCloudflare Error 525 (SSL Handshake Failed): Causes and Fixes
Error 525 means Cloudflare reached your origin but the TLS handshake failed. How to test the origin directly, the usual causes, and how 525 differs from 526.
DiagnoseCloudflare Error 526 (Invalid SSL Certificate): Causes and Fixes
Error 526 means Full (strict) rejected your origin certificate. How to see what Cloudflare sees, read the openssl verify code, and fix expiry, chain and name.
DiagnoseCloudflare SSL Modes: Flexible vs Full vs Full (strict)
What Off, Flexible, Full and Full (strict) do on the Cloudflare-to-origin leg, which one to use, and why the wrong one causes redirect loops, 521 or 526.
Diagnosecurl: (35) SSL connect error — fix the handshake
curl: (35) SSL connect error means the TLS handshake died before any cert check — a version, cipher, or port mismatch. Split server vs client. Free instant check, no sign-up.
Diagnosecurl: (60) SSL certificate problem — fix
curl: (60) SSL certificate problem means curl can't trust the chain. Check the intermediate, your CA bundle, and any proxy. Free instant check, no sign-up.
DiagnoseERR_BAD_SSL_CLIENT_AUTH_CERT: Client Cert Rejected
ERR_BAD_SSL_CLIENT_AUTH_CERT means a site's mTLS check rejected your client certificate — missing, expired, or untrusted. Free instant check, no sign-up.
DiagnoseERR_SSL_BAD_RECORD_MAC_ALERT in Chrome: Fix
ERR_SSL_BAD_RECORD_MAC_ALERT means a TLS record was corrupted, not a bad certificate. Check MTU, Wi-Fi, and antivirus. Free instant check, no sign-up.
DiagnoseERR_SSL_DECRYPT_ERROR_ALERT in Chrome: Fix
ERR_SSL_DECRYPT_ERROR_ALERT means a TLS handshake signature failed, not a bad cert. Isolate client, middlebox, or server. Free instant check, no sign-up.
DiagnoseERR_SSL_KEY_USAGE_INCOMPATIBLE: Wrong Cert Purpose
ERR_SSL_KEY_USAGE_INCOMPATIBLE means the cert's keyUsage or EKU forbids TLS server use. Isolate it in 3 checks. Free instant check, no sign-up.
DiagnoseERR_SSL_OBSOLETE_VERSION Fix (TLS 1.0/1.1)
ERR_SSL_OBSOLETE_VERSION means your site still serves deprecated TLS 1.0/1.1. Fix in 3 steps: enable TLS 1.2/1.3, fix the CDN, re-test. Free instant check.
DiagnoseERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN: MITM
ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN means a pinned Google cert was re-signed in your path. Find the interceptor in 3 checks. Free instant SSL check, no sign-up.
DiagnoseERR_SSL_PROTOCOL_ERROR: What It Means and How to Fix It
ERR_SSL_PROTOCOL_ERROR: the server's reply wasn't valid TLS. Find out if it's you or the site, then fix HTTP on port 443, missing certs and middleboxes.
DiagnoseERR_SSL_UNRECOGNIZED_NAME_ALERT: Fix the SNI Alert
ERR_SSL_UNRECOGNIZED_NAME_ALERT means the server rejected your SNI hostname before any cert. Check vhost, cert names, and SNI. Free instant check, no sign-up.
DiagnoseERR_SSL_VERSION_OR_CIPHER_MISMATCH: Causes and How to Fix It
Chrome's 'unsupported protocol' error means the TLS handshake found no version or cipher in common. How to see what the server offers, and fix each cause.
DiagnoseERR_SSL_WEAK_EPHEMERAL_DH_KEY: It's the Server
ERR_SSL_WEAK_EPHEMERAL_DH_KEY: a server's Diffie-Hellman key is too small to trust. Fix it with strong DH params or ECDHE. Free instant check, no sign-up.
DiagnoseError 1013: HTTP Hostname and TLS SNI Mismatch (Fix)
Error 1013 means your TLS SNI and HTTP Host header disagree. Fix in 3 checks: client SNI, SSL-proxy networks, and custom Host overrides. Free instant check.
Diagnoseerror:0A000126:SSL routines::unexpected eof while reading
error:0A000126 unexpected eof while reading: the TLS peer closed without a clean shutdown. Tell benign log noise from a real failure. Free instant check.
DiagnoseIncomplete SSL Chain or Hostname Mismatch: Find and Fix It
Works in Chrome but fails in curl, Java or Android? Usually a missing intermediate. Check the served chain; fix fullchain vs cert.pem, order and key mismatch.
DiagnoseMOZILLA_PKIX_ERROR_INADEQUATE_KEY_SIZE: Fix
MOZILLA_PKIX_ERROR_INADEQUATE_KEY_SIZE: Firefox blocked a sub-2048-bit RSA key. Find the cert in 3 checks — leaf, chain, proxy. Free instant check, no sign-up.
DiagnoseMOZILLA_PKIX_ERROR_MITM_DETECTED (Firefox) Fix
MOZILLA_PKIX_ERROR_MITM_DETECTED: something is intercepting your TLS. Tell antivirus scanning from a real attack in 3 checks. Free instant check, no sign-up.
DiagnoseMOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE (Firefox)
MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE means a cert isn't valid yet — usually a wrong clock. Check in 3 steps. Free instant check, no sign-up.
DiagnoseMOZILLA_PKIX_ERROR_SELF_SIGNED_CERT: Fix in Firefox
MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT: Firefox rejected a self-signed cert. Fix in 3 checks — chain, issuer, trust store. Free instant check, no sign-up.
DiagnoseNET::ERR_CERT_AUTHORITY_INVALID: Causes and Fixes
NET::ERR_CERT_AUTHORITY_INVALID: Chrome can't trace the certificate to a trusted root. Read the issuer, find the cause, fix it as a visitor or site owner.
DiagnoseNET::ERR_CERT_COMMON_NAME_INVALID: Causes and Fixes
Chrome shows NET::ERR_CERT_COMMON_NAME_INVALID when the certificate's SAN list doesn't include the name you typed. How to read the SAN list, the seven usual causes, and the fix for each.
DiagnoseNET::ERR_CERT_DATE_INVALID: Expired Certificate or Wrong Clock?
NET::ERR_CERT_DATE_INVALID means the certificate looks expired or not yet valid to this device. How to tell a wrong clock from a real expiry, and fix both.
DiagnoseNET::ERR_CERT_INVALID Fix (No Proceed Link)
NET::ERR_CERT_INVALID blocks a malformed cert, no bypass. 3 checks find it: all sites vs one, middlebox, or broken cert. Free instant check, no sign-up.
DiagnoseNET::ERR_CERT_KNOWN_INTERCEPTION_BLOCKED: MITM
NET::ERR_CERT_KNOWN_INTERCEPTION_BLOCKED means Chrome flagged an interception cert in your TLS chain. See who is intercepting in 3 checks. Free instant SSL check, no sign-up.
DiagnoseNET::ERR_CERT_NAME_CONSTRAINT_VIOLATION Fix
NET::ERR_CERT_NAME_CONSTRAINT_VIOLATION: a trusted CA can't issue this name. Fix in 3 checks: chain, constraints, SANs. Free instant check, no sign-up.
DiagnoseNET::ERR_CERT_NON_UNIQUE_NAME: Internal Name Cert
NET::ERR_CERT_NON_UNIQUE_NAME means the cert covers an internal name or private IP no public CA may certify. Fix in 3 checks. Free instant check, no sign-up.
DiagnoseNET::ERR_CERT_REVOKED: Fix a Revoked Certificate
NET::ERR_CERT_REVOKED means a CA revoked the certificate. Check if it's truly revoked, which cert you serve, then reissue. Free instant check, no sign-up.
DiagnoseNET::ERR_CERT_SYMANTEC_LEGACY: Fix in Chrome
NET::ERR_CERT_SYMANTEC_LEGACY means Chrome distrusts a legacy Symantec cert. Check the issuer, then reissue from a modern CA. Free instant check, no sign-up.
DiagnoseNET::ERR_CERT_VALIDITY_TOO_LONG: Fix the 398-Day Cap
NET::ERR_CERT_VALIDITY_TOO_LONG means your cert exceeds the 398-day limit. Check the validity span, then reissue a shorter cert. Free instant check, no sign-up.
DiagnoseNET::ERR_CERT_WEAK_KEY in Chrome: Fix
NET::ERR_CERT_WEAK_KEY: a cert's RSA key is too small for Chrome. Find the weak cert in the chain and reissue at 2048-bit. Free instant check, no sign-up.
DiagnoseNET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM: SHA-1 Cert Fix
NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM means a SHA-1 signature is in the chain — leaf or intermediate, never the root. Find which cert in 3 checks. Free instant check, no sign-up.
DiagnoseNET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED Fix
NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED: no proof the cert was CT-logged. Tell a real cert from TLS interception in 3 checks. Free instant SSL check.
DiagnoseNo Required SSL Certificate Was Sent (nginx 496)
No required SSL certificate was sent means nginx wanted an mTLS client cert and got none. Isolate client vs server in 3 steps. Free instant check, no sign-up.
DiagnoseOCSP Stapling Not Enabled? Check If You Still Need It
OCSP stapling not enabled? Check whether your CA still runs OCSP — Let's Encrypt dropped it — then enable and verify in 3 steps. Free instant check.
DiagnosePKIX path building failed (Java) — truststore fix
PKIX path building failed: Java can't chain the cert to a root in its cacerts store. Import the missing CA or fix the server. Free instant check, no sign-up.
DiagnosePost-Quantum Migration Timeline: 2027–2035 Deadlines
Post-quantum migration timeline: Korea's 2027–2029 NIS milestones, NIST's 2030/2035 cutoffs, and what a public website should switch first. Free check.
DiagnosePost-Quantum TLS Check: Is Your Site Using X25519MLKEM768?
Post-quantum TLS check in 3 steps: test hybrid X25519MLKEM768 key exchange, see if your server or CDN provides it, then turn it on. Free instant check.
DiagnosePR_END_OF_FILE_ERROR Fix Guide (Firefox)
PR_END_OF_FILE_ERROR: connection closed before the TLS handshake finished. Server fault or local middlebox? Find out in 3 checks. Free SSL check, no sign-up.
DiagnoseSafari Can't Establish a Secure Connection: Fix
Safari Can't Establish a Secure Connection to the Server: isolate client vs server in 5 checks — clock, certificate, Apple's rules. Free instant check, no sign-up.
DiagnoseSEC_ERROR_EXPIRED_CERTIFICATE (Firefox)
SEC_ERROR_EXPIRED_CERTIFICATE means Firefox sees an expired certificate, or your clock is wrong. Tell them apart in 3 checks. Free instant check, no sign-up.
DiagnoseSEC_ERROR_EXPIRED_ISSUER_CERTIFICATE (Firefox)
SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE means a root or intermediate in your chain expired, not the leaf. Find it in 3 checks. Free instant check, no sign-up.
DiagnoseSEC_ERROR_REVOKED_CERTIFICATE in Firefox: Fix
SEC_ERROR_REVOKED_CERTIFICATE: Firefox found the cert on a revocation list. Server serving a revoked cert, or a local proxy? Free instant check, no sign-up.
DiagnoseSEC_ERROR_UNKNOWN_ISSUER (Firefox) Fix
SEC_ERROR_UNKNOWN_ISSUER: Firefox can't chain your certificate to a trusted root. Check for a missing intermediate or antivirus HTTPS scanning. Free instant check, no sign-up.
DiagnoseSSL Certificate Expired or Expiring: Renewal Checklist
Recover from an expired SSL certificate, check expiry with openssl -checkend, fix renewal hooks, and find every copy before the 200-day limit bites.
DiagnoseSSL_ERROR_BAD_CERT_ALERT in Firefox: Fix
SSL_ERROR_BAD_CERT_ALERT: the server rejected your client certificate, not its own. Check the cert, its CA, and expiry. Free instant check, no sign-up.
DiagnoseSSL_ERROR_BAD_CERT_DOMAIN in Firefox: Fix It
SSL_ERROR_BAD_CERT_DOMAIN means the cert doesn't cover this hostname. Check the SAN list, www vs apex, and wildcard scope. Free instant check, no sign-up.
DiagnoseSSL_ERROR_HANDSHAKE_FAILURE_ALERT in Firefox: Fix
SSL_ERROR_HANDSHAKE_FAILURE_ALERT: the server refused the handshake, not the cert. Check TLS version, ciphers, client certs. Free instant check, no sign-up.
DiagnoseSSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT: Firefox Fix
SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT is a rejected TLS downgrade, not a cert error. Check antivirus HTTPS scanning, proxies. Free instant check, no sign-up.
DiagnoseSSL_ERROR_NO_CYPHER_OVERLAP in Firefox: Fix
SSL_ERROR_NO_CYPHER_OVERLAP: Firefox and the server share no TLS version or cipher. Fix in 3 checks: protocol, cipher, SNI. Free instant check, no sign-up.
DiagnoseSSL_ERROR_RX_RECORD_TOO_LONG in Firefox: Fix
SSL_ERROR_RX_RECORD_TOO_LONG usually means plain HTTP on port 443. Fix in 3 checks: the ssl directive, the port, the proxy. Free instant check, no sign-up.
DiagnoseSSL_ERROR_UNSUPPORTED_VERSION Fix (Firefox)
SSL_ERROR_UNSUPPORTED_VERSION: server offers only TLS 1.0/1.1, Firefox refuses. Fix at the server, not about:config. Free instant check, no sign-up.
Diagnosessl.SSLCertVerificationError: certificate verify failed
ssl.SSLCertVerificationError: certificate verify failed: Python can't trust the chain. Check certifi and the server intermediate. Free instant check.
Diagnosetoo many certificates already issued (Let's Encrypt)
'too many certificates already issued'? It's a deploy loop, not renewals. Spot it in CT logs, use staging, wait out the token bucket. Free instant check.
DiagnoseUNABLE_TO_VERIFY_LEAF_SIGNATURE (Node.js) — fix
UNABLE_TO_VERIFY_LEAF_SIGNATURE means Node can't reach a trusted root. Fix the server intermediate or NODE_EXTRA_CA_CERTS. Free instant check, no sign-up.
Diagnoseverify error:num=20: unable to get local issuer certificate
verify error:num=20 unable to get local issuer certificate? Tell a missing intermediate from a missing CA in two checks. Free instant check, no sign-up.
DiagnoseWildcard SSL Certificates: What They Cover and When to Use One
What *.example.com covers and what it doesn't, how to get a free wildcard from Let's Encrypt with DNS-01, and the security cost of sharing one key.
DiagnoseX25519MLKEM768 Explained: The Hybrid TLS Key Exchange
X25519MLKEM768 is the hybrid TLS 1.3 key exchange default in Chrome: what each half does, why they're paired, and how to check your site. Free instant check.
Diagnose