Chrome / Firefox / Safari SSL Errors Reference
Breakdown of 11+ most common SSL/TLS errors: NET::ERR_CERT_AUTHORITY_INVALID, ERR_CERT_DATE_INVALID, SSL_ERROR_PROTOCOL_ERROR, Mixed Content and more. Causes, step-by-step fix + online checker.
SSL / TLS 61
"Trust anchor for certification path not found"
Key idea: Android throws this (java.security.cert.CertPathValidatorException) when the server certificate is signed by a CA missing from the Android system truststore. Three causes…
Read →SSL_ERROR_BAD_CERT_DOMAIN in Firefox: How to Fix a Certificate Name Mismatch
What it means: The certificate's Subject Alternative Name list does not include the hostname in Firefox's address bar.Check the exact address, including wwwRead the names Firefox s…
Read →Cloudflare Error 526: Invalid SSL Certificate on the Origin, and How to Fix It
What it means: In Full (strict) mode Cloudflare could not validate your origin server's certificate.Inspect the certificate the origin servesRenew it if expired; add missing hostna…
Read →curl: (35) SSL Connect Error. Read the Reason and Fix the Handshake
What it means: curl reached the server, but the TLS handshake failed before any HTTP was sent.Read the reason after the codeRun curl -v and note the last TLS stepTest versions with…
Read →curl: (77) Problem With the SSL CA Cert: How to Fix It
What it means: curl could not read the CA bundle it was configured to use, so no HTTPS request can start.Check which CA file path the error namesFix or unset CURL_CA_BUNDLE, --cace…
Read →NET::ERR_CERT_AUTHORITY_INVALID: How to Fix It in Chrome and Edge
What it means: Chrome could not chain the site's certificate to a root certificate it trusts.Check who issued it in the certificate viewerTry another network with antivirus HTTPS s…
Read →ERR_CERT_COMMON_NAME_INVALID: Domain Mismatch
TL;DR: ERR_CERT_COMMON_NAME_INVALID (NET::ERR_CERT_COMMON_NAME_INVALID) means the requested domain is not listed in the certificate's SAN field. Example: cert issued for examp…
Read →NET::ERR_CERT_DATE_INVALID: How to Fix an Expired Certificate or Wrong Clock
What it means: By your device's clock, the site's certificate has expired or is not valid yet.Check your device date, time and time zoneRetry from another device or networkIf it fa…
Read →NET::ERR_CERT_INVALID: Why Chrome Blocks the Site and How to Fix It
What it means: Chrome found a certificate defect outside the specific trust, name and date checks, and offers no bypass.Retry on another network and browserIf it fails everywhere: …
Read →CAA Violation: Certificate Not Authorized
Key idea: CAA (Certificate Authority Authorization) violation — the domain's DNS CAA record does not permit the specified CA to issue a cert. Let's Encrypt, DigiCert and others che…
Read →NET::ERR_CERT_REVOKED: What Happened
Key idea: NET::ERR_CERT_REVOKED — your CA (Let's Encrypt, DigiCert) revoked the SSL certificate. Serious: clients can't connect at all. Causes: compromised private key, mis-issuanc…
Read →ERR_CERT_SYMANTEC_LEGACY: Legacy Certificate
Key idea: NET::ERR_CERT_SYMANTEC_LEGACY — Chrome 70+ (October 2018) automatically distrusts certificates from Symantec, VeriSign, Thawte, GeoTrust and RapidSSL issued before Decemb…
Read →NET::ERR_CERT_VALIDITY_TOO_LONG: How to Fix Certificate Lifetime
What it means: The public certificate is valid longer than Chrome allows for its issue date: 398 days, 200 since March 2026.Reload; then try another network to compareIf it fails e…
Read →ERR_CERT_WEAK_SIGNATURE_ALGORITHM: Obsolete SHA-1/MD5
TL;DR: ERR_CERT_WEAK_SIGNATURE_ALGORITHM means the SSL certificate is signed with an obsolete algorithm (SHA-1, MD5, MD2). Chrome blocks such certificates since 2017. Fix: reissue …
Read →ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY
Key idea: ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY — Chrome refused an HTTP/2 connection because the TLS setup does not meet RFC 7540 requirements: TLS 1.2 minimum, AEAD cipher (GCM…
Read →ERR_QUIC_HANDSHAKE_FAILED
Key idea: ERR_QUIC_HANDSHAKE_FAILED — initial cryptographic handshake in QUIC failed. QUIC uses TLS 1.3 (mandatory), so all TLS 1.3 handshake errors can manifest. Usually: server c…
Read →ERR_SSL_BAD_HANDSHAKE_HASH_VALUE
Key idea: ERR_SSL_BAD_HANDSHAKE_HASH_VALUE — client detected a hash mismatch in the TLS handshake. May indicate MITM or packet corruption. More often: legacy cipher suite with SHA-…
Read →ERR_SSL_BAD_RECORD_MAC_ALERT: Causes & Fix
Key idea: ERR_SSL_BAD_RECORD_MAC_ALERT means the client or server received a TLS record with an invalid MAC (Message Authentication Code). The data was corrupted in transit: networ…
Read →ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED: Fix Client Certificate Signing
What it means: Chrome picked your client certificate, but signing the TLS handshake with its private key failed on your device.Reinsert the smart card or token, enter PIN.Restart t…
Read →ERR_SSL_DECOMPRESSION_FAILURE_ALERT: What It Is
Key idea: ERR_SSL_DECOMPRESSION_FAILURE_ALERT — TLS alert 30. Historically appeared when client and server failed to agree on compression. Rarely seen in 2026: TLS compression is o…
Read →ERR_SSL_KEY_USAGE_INCOMPATIBLE: How to Fix the Certificate Key Usage
What it means: The server certificate's keyUsage extension does not permit the key exchange this TLS handshake negotiated.Retry from another network or devicePause antivirus or pro…
Read →ERR_SSL_OBSOLETE_VERSION: Fix
Key idea: ERR_SSL_OBSOLETE_VERSION — Chrome 84+ (July 2020) blocks HTTPS connections to servers supporting only TLS 1.0 or 1.1. Causes: old nginx/Apache, legacy IIS 7, embedded dev…
Read →ERR_SSL_OCSP_INVALID_RESPONSE
Key idea: ERR_SSL_OCSP_INVALID_RESPONSE — Chrome received an OCSP response but it is corrupted, expired (> 7 days), or signed by the wrong responder cert. Fix: disable ssl_stapling…
Read →ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN: Fix
Key idea: NET::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN means the browser expected a specific public key (HPKP or Certificate Transparency static pin) in the cert chain but it is missi…
Read →ERR_SSL_PROTOCOL_ERROR: How to Fix "Sent an Invalid Response"
What it means: Chrome started a TLS handshake, but the server's reply was not valid TLS, so the connection was dropped.Reload in an incognito window, then another browser.Turn off …
Read →ERR_SSL_SERVER_CERT_BAD_FORMAT
Key idea: ERR_SSL_SERVER_CERT_BAD_FORMAT — browser could not parse the server certificate. ASN.1/DER encoding error, truncated cert, base64 issue, or non-standard extensions. Fix: …
Read →ERR_SSL_UNRECOGNIZED_NAME_ALERT
Key idea: ERR_SSL_UNRECOGNIZED_NAME_ALERT — TLS alert 112: server has no cert for the requested SNI hostname. Causes: misconfigured nginx (missing server_name), Cloudflare Workers …
Read →ERR_SSL_UNRECOGNIZED_NAME_ALERT: Server Does Not Know This Hostname
What it means: The server received your hostname via SNI, has no site configured for it, and aborted the TLS handshake.Check you typed the right domain, not an IP.Try another netwo…
Read →ERR_SSL_VERSION_OR_CIPHER_MISMATCH: Causes and How to Fix It
What it means: Chrome and the server found no TLS version, cipher or certificate they could both use for this hostname.Retry with antivirus HTTPS scanning and VPN off.Fails everywh…
Read →ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY
Key idea: ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY — Chrome detected the server using a Diffie-Hellman ephemeral key below 1024 bits (Logjam attack, 2015). Precomputation lets an attac…
Read →SEC_ERROR_OCSP_OLD_RESPONSE
Key idea: Firefox/NSS throws this when the server returned an OCSP Stapling response with nextUpdate in the past (stale). Usual cause — the server's OCSP cache expired and nginx/ap…
Read →x509: Certificate Signed by Unknown Authority (Go, Docker, kubectl): How to Fix
What it means: Go could not chain the server's certificate to any root in its trust pool.Check the image has CA certificatesRead who issued the server certificatePrivate CA: add it…
Read →HSTS Error: Why You Cannot Bypass It and How to Fix It
What it means: The site uses HSTS, so the browser blocks a certificate error and removes the option to proceed.Check your device date and timeTry another network; avoid captive por…
Read →PKIX path building failed (Java)
Key idea: Java SSLException "PKIX path building failed: unable to find valid certification path to requested target" — Java cannot build the trust chain. JVM truststore ($JAVA_HOME…
Read →javax.net.ssl.SSLPeerUnverifiedException: Hostname Not Verified or Pinning Failure
What it means: Java could not confirm the server's identity: the name, the pin or the certificate itself is missing.Read the exception messageCompare host name with the certificate…
Read →Mixed Content: HTTPS Page Loading HTTP Resources
TL;DR: Mixed Content means an HTTPS page loads resources (JS, CSS, images, iframes) over HTTP. Chrome blocks active mixed content entirely; passive triggers a warning. Fix: replace…
Read →MOZILLA_PKIX_ERROR_MITM_DETECTED in Firefox: How to Fix It
What it means: Something on your device or network re-signs HTTPS traffic with a root certificate Firefox does not trust.Check the certificate issuer on the error pageDisable antiv…
Read →MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING
Key idea: MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING — cert carries the tlsfeature extension (RFC 7633) with OCSP Must-Staple flag, but the server is not stapling an OCSP resp…
Read →MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT in Firefox: How to Fix It
What it means: The server certificate is signed by its own key, so no trusted CA vouches for it.Confirm issuer equals subject in View CertificateOn intranets or devices, verify it …
Read →ERR_CERTIFICATE_TRANSPARENCY_REQUIRED: Fix
Key idea: NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED — since October 2017 Chrome requires every public SSL cert to be logged in Certificate Transparency (CT). Cert without an SCT (…
Read →Hostname/IP Does Not Match Certificate's Altnames (ERR_TLS_CERT_ALTNAME_INVALID)
What it means: The certificate is trusted, but it is not issued for the host name or IP your code connected to.Read the host and altnames in the messageConnect by a name the certif…
Read →NSURLErrorServerCertificateUntrusted: iOS Fix
Key idea: NSURLErrorServerCertificateUntrusted (code -1202) — the iOS/macOS Foundation Network layer rejected the server SSL cert. Cause: self-signed, expired, untrusted CA, empty …
Read →Certificate Has Expired in curl, Node.js and OpenSSL: Find Which One and Fix It
What it means: A certificate in the chain is past its expiry date, by the client's clock.Check the client's date and timeFind the expired certificate's depthLeaf expired: renew and…
Read →Self-Signed Certificate in Certificate Chain (npm, Node.js, curl, Python): Fix
What it means: The chain ends in a root certificate that your client's trust store does not contain.Print the chain and read the rootCorporate proxy or antivirus root? Trust itPriv…
Read →Unable to Get Local Issuer Certificate (curl 60, Git, Node.js): How to Fix
What it means: The client could not find, in its own trust store, the issuer of a certificate the server sent.Check the chain with openssl s_client -showcertsServer owner: serve th…
Read →Unable to Verify the First Certificate (UNABLE_TO_VERIFY_LEAF_SIGNATURE): Fix
What it means: The server sent only its own certificate, so the client could not check who signed it.Count the certificates with -showcertsFind the missing intermediate via AIAServ…
Read →SSL routines: wrong version number. The Other End Is Not Speaking TLS
What it means: The client started TLS, but the server answered with something that is not TLS, usually plain HTTP.Check the port and URL schemeCheck https_proxy uses http://Server:…
Read →Python ssl.SSLCertVerificationError
Key idea: Python requests/urllib3 fails with ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] unable to get local issuer certificate. Python takes its CA bundle from …
Read →SSL_ERROR_RX_RECORD_TOO_LONG: Non-TLS Response
TL;DR: SSL_ERROR_RX_RECORD_TOO_LONG means Firefox expected TLS but received HTTP or other plain text. 90% of cases: server is listening on port 443 as HTTP (not HTTPS). Check your …
Read →Schannel 0x80072f7d
Key idea: HRESULT 0x80072F7D = WININET_E_SECURITY_CHANNEL_ERROR — Windows Schannel (TLS stack) failed to establish the connection. Four causes: (1) server requires TLS 1.2/1.3, Win…
Read →SEC_ERROR_CA_CERT_INVALID
Key idea: SEC_ERROR_CA_CERT_INVALID — Firefox treats the intermediate/root CA cert as invalid. Causes: expired CA cert, malformed DER encoding, deprecated CA (Symantec 2018), root …
Read →SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE
Key idea: This error means the intermediate CA certificate in your site's chain has expired, even though your own leaf certificate is still valid. The browser cannot verify the sig…
Read →SEC_ERROR_INADEQUATE_KEY_USAGE in Firefox: How to Fix It
What it means: A certificate in the chain has a keyUsage extension that forbids its role: signing the handshake or issuing certificates.Retry from another network or devicePause an…
Read →SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION
Key idea: SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION — cert carries an X.509 extension marked critical=TRUE, but Firefox does not recognise the OID. Per RFC 5280, a client MUST reject ce…
Read →SEC_ERROR_UNKNOWN_ISSUER in Firefox: How to Fix It
What it means: Firefox could not link the site's certificate to any root CA it trusts.Check the issuer under Advanced, View CertificateDisable antivirus HTTPS scanning or change ne…
Read →SSL_ERROR_NO_CIPHER_OVERLAP
Key idea: Firefox could not find a common cipher suite with your server during the TLS handshake. In 2026 this error usually means the server supports only TLS 1.0/1.1 (Firefox dis…
Read →SSL_ERROR_NO_CYPHER_OVERLAP in Firefox
Key idea: SSL_ERROR_NO_CYPHER_OVERLAP — Firefox (same as ERR_SSL_VERSION_OR_CIPHER_MISMATCH in Chrome) could not agree on a TLS cipher suite with the server. Both sides have allowe…
Read →SSL_ERROR_NO_RENEGOTIATION
Key idea: SSL_ERROR_NO_RENEGOTIATION — Firefox tried to renegotiate the TLS session (e.g. for client cert auth on a specific path), but the server refused. Renegotiation is depreca…
Read →SSL_ERROR_PROTOCOL_VERSION_ALERT: Why the Server Refuses Your TLS Version
What it means: The server answered with TLS alert 70 (protocol_version): it refuses every TLS version Firefox offered.Reset security.tls.version prefs in about:config.Turn off anti…
Read →SSL_ERROR_RX_UNKNOWN_RECORD_TYPE
Key idea: SSL_ERROR_RX_UNKNOWN_RECORD_TYPE — Firefox received a TLS record with unknown content type (not 20, 21, 22, 23, 24). Frequent: MITM proxy inserting garbage, HTTP error pa…
Read →SSL Handshake Failed: TLS Connection Setup Failure
TL;DR: SSL Handshake Failed means the TLS handshake between client and server did not complete. Causes: outdated SNI, TLS version mismatch, client certificate required, time skew &…
Read →Other 9
Cloudflare Error 1003: Direct IP Access Not Allowed. Use the Hostname
What it means: Something requested a Cloudflare IP address directly, without a hostname Cloudflare can match to a website.Open the site by its domain nameRemove hard-coded Cloudfla…
Read →Cloudflare Error 521: Web Server Is Down. Why the Origin Refuses Cloudflare
What it means: Cloudflare reached your origin's IP, but the server refused the connection.Check the web server process is runningAllow Cloudflare IP ranges in the firewallListen on…
Read →Cloudflare Error 523: Origin Is Unreachable. Finding the Broken Route
What it means: Cloudflare could not reach your origin's IP address at all, because no network route to it worked.Confirm the origin IP in Cloudflare DNSCheck the server's IP did no…
Read →no healthy upstream (Envoy, Istio): Why the Cluster Has No Endpoints
What it means: Envoy found no usable endpoint in the target cluster and answered 503 itself, without contacting your backend.List the cluster's endpoints in EnvoyCheck that pods ar…
Read →upstream connect error or disconnect/reset before headers: Reading the Reset Reason
What it means: Envoy picked a backend, but the connection failed or was reset before any response headers arrived.Read the reset reason after the messageCheck the backend listens o…
Read →upstream request timeout (Envoy, Istio): Why the Proxy Gave Up and Returned 504
What it means: The backend accepted the request but did not finish its response within Envoy's route timeout, so Envoy answered 504.Find which route timeout appliedMeasure the back…
Read →write EPIPE / Broken Pipe: Why Writes Fail After the Peer Closes
What it means: Your process wrote data into a socket or pipe whose reading side was already closed.Find what closed the other endCheck upload size limits and timeoutsStop writing a…
Read →no live upstreams while connecting to upstream: What nginx Is Telling You
What it means: nginx had no available server left in the upstream group, so it returned 502 without connecting.Find the earlier error that marked servers failedBring the backends b…
Read →upstream prematurely closed connection while reading response header from upstream
What it means: The backend closed the connection before nginx received its complete response, so nginx returned 502 or cut the reply short.Note whether it says header or upstreamCh…
Read →Ping & Ports 7
curl: (28) Operation Timed Out. Find the Phase That Stalled and Fix It
What it means: curl gave up because a time limit expired before the request finished.Read which phase the message namesTime each phase with curl -wCheck the port is open from outsi…
Read →connect ECONNREFUSED 127.0.0.1:3000 — Why Nothing Is Listening and How to Fix It
What it means: The target host answered your connection attempt with a refusal: no process listens on that address and port.Start the service and check its portCompare the address …
Read →Error: read ECONNRESET (Connection Reset by Peer): Causes and Fixes
What it means: The other end, or something between, abruptly reset an open TCP connection while your code used it.Note whether it happens on reused connectionsKeep server keep-aliv…
Read →ERR_ADDRESS_UNREACHABLE: No Route to the Server. How to Fix
What it means: Chrome has no network route to the IP address it got from DNS, so the connection never started.Check the device is on, same networkOn a Mac, allow Chrome Local Netwo…
Read →ERR_CONNECTION_RESET: The Connection Was Reset. How to Fix
What it means: A TCP reset packet, from the server or a device in between, tore down an established connection.Try mobile data or another networkDisable VPN, proxy or antivirus HTT…
Read →Error: connect ETIMEDOUT — Why the Connection Gets No Answer
What it means: Your connection attempt got no reply at all: packets were dropped or the host is unreachable.Check the IP and port in the errorTest the port from another networkOpen…
Read →"The Connection Was Reset" in Firefox: Causes and Fixes
What it means: Firefox's connection was cut by a TCP reset, or the server closed it before sending any data.Retry on another network or mobile dataCheck Firefox's proxy in Network …
Read →DNS & Domains 6
Cloudflare Error 1016: Origin DNS Error. Why Cloudflare Cannot Find Your Server
What it means: Cloudflare could not resolve the address of your origin server, so it had nowhere to send the request.Open the record for the failing hostnameResolve its CNAME targe…
Read →NXDOMAIN (DNS RCODE 3): Why the Name Does Not Exist and How to Fix It
What it means: The DNS answered that this exact name does not exist in its zone; no record of any type is published for it.Check the spelling and the zoneRun dig +trace on the name…
Read →DNS SERVFAIL (RCODE 2): Find Whether It Is DNSSEC or a Dead Nameserver
What it means: The resolver tried to answer but failed: validation broke or no authoritative server gave a usable reply.Repeat the query with dig +cdIf +cd works, fix DNSSECQuery e…
Read →ERR_DNS_MALFORMED_RESPONSE
Key idea: ERR_DNS_MALFORMED_RESPONSE — Chrome DNS resolver received a response that does not conform to DNS wire format. Causes: upstream resolver bug (rare), DNSSEC validation fai…
Read →ERR_ICANN_NAME_COLLISION
Key idea: ERR_ICANN_NAME_COLLISION — ICANN-level warning. Your internal network uses a domain (.corp, .home, .lan) that became a public TLD after ICANN gTLD expansion (2013+). Now …
Read →Error: getaddrinfo ENOTFOUND — Why the Host Name Does Not Resolve
What it means: The system resolver found no address for the host name your code tried to connect to.Check the exact host name in the errorRemove https:// and paths from host fields…
Read →HTTP & APIs 4
ERR_EMPTY_RESPONSE: Server Didn't Send Any Data. How to Fix
What it means: The server accepted the connection and request, then closed it without sending any response data.Reload once, then try another networkPause VPN, proxy or antivirus w…
Read →ERR_HTTP_RESPONSE_CODE_FAILURE (-379): Where It Comes From and How to Fix
What it means: A Chromium component that checks the HTTP status itself got a non-2xx answer, often a 4xx/5xx with an empty body.Reload once, then try another networkCapture the fai…
Read →ERR_INCOMPLETE_CHUNKED_ENCODING: Truncated Response and How to Fix It
What it means: The server started a chunked HTTP/1.1 response, then the connection closed before the final chunk arrived.Reload, then try another networkPause VPN, proxy or antivir…
Read →NET::ERR_INVALID_HTTP_RESPONSE
Key idea: NET::ERR_INVALID_HTTP_RESPONSE — Chrome received a response from server that does not parse as valid HTTP. Causes: Content-Length does not match body size, invalid header…
Read →Other 3
ERR_HPACK_DECODING_FAILED
Key idea: ERR_HPACK_DECODING_FAILED — HTTP/2 client could not decompress HPACK-encoded headers. HPACK — Huffman-based header compression for HTTP/2 (RFC 7541). Error: server sent m…
Read →ERR_HTTP2_PROTOCOL_ERROR: How to Fix the HTTP/2 Protocol Error
What it means: Chrome received an HTTP/2 response that broke the protocol rules, usually a malformed header or a truncated body.Reload in an incognito window without extensionsTry …
Read →ERR_QUIC_PROTOCOL_ERROR: How to Fix the HTTP/3 (QUIC) Error
What it means: Chrome's HTTP/3 connection over UDP (QUIC) broke after the response had started, so it could not retry over TCP.Reload the page onceTry another network or disconnect…
Read →Other 4
"Has Been Blocked by CORS Policy": Every Variant and Its Fix
What it means: The API answered, but its headers did not allow your page's origin to read the response.Read the reason after "CORS policy:"Return Access-Control-Allow-Origin for yo…
Read →TypeError: Failed to fetch — Why fetch() Rejects and How to Fix It
What it means: The browser's fetch() got no readable response: the request failed on the network, or CORS hid the answer.Read the DevTools Console line above itCheck the request in…
Read →ERR_BLOCKED_BY_RESPONSE: Which Header Blocked It and How to Fix
What it means: Chrome got the response, but its X-Frame-Options, CSP frame-ancestors, CORP or COEP header forbids this use.Read the DevTools console message firstOpen the blocked p…
Read →ERR_TOO_MANY_REDIRECTS: How to Find and Fix a Redirect Loop
What it means: The browser followed 20 redirects without reaching a page, almost always because two rules send the request back and forth.Delete cookies for this site and reloadTry…
Read →