Card 07/ 10
Certificate Errors: Expired, Wrong Name and Unknown Issuer
Three errors look alike in a browser and have three different causes and fixes.
Certificate errors stop a TLS connection when one of the client's checks on the chain fails, and the three most common, an expired certificate, a wrong name and an unknown issuer, have different causes and fixes. Browsers show all three behind a similar warning page, so the error code underneath is what tells them apart.
Picture a team that deploys a new server for its site. The site works in Chrome on every developer's laptop. Their monitoring, which uses curl, reports the site down with "unable to get local issuer certificate", and so does a partner's server calling the API. Chrome had fetched the missing intermediate certificate itself; curl and the partner's server did not.
The symptom. A browser warning page, or a failed call with one of the messages in the table.
| Error | Cause | How to confirm | Fix |
|---|---|---|---|
| Expired: "certificate has expired", NET::ERR_CERT_DATE_INVALID | The leaf or an intermediate is past its end date, or the client's clock is wrong | Read the validity dates with openssl, and check the client's clock | Renew the certificate, and automate renewal |
| Wrong name: "hostname mismatch", NET::ERR_CERT_COMMON_NAME_INVALID | The host requested is not among the certificate's names | Read the subject alternative names and compare with the address used | Issue a certificate that lists the name, or use the listed one |
| Unknown issuer: "unable to get local issuer certificate", NET::ERR_CERT_AUTHORITY_INVALID | The server does not send its intermediate, or the chain ends at a root the client does not trust | Check how many certificates the server sends with openssl | Send the full chain, or add the private root to the client's trust store |
Why it happens. Each error is one failed check on the chain. Expiry is a date check. A wrong name is a comparison between the address typed and the names listed: a certificate for *.example.com covers shop.example.com but not example.com itself or a.b.example.com. An unknown issuer means the chain could not be completed to a trusted root.
What it costs. The unknown issuer case misleads: a browser that completes the chain itself hides the fault, while every program calling the API fails.
What to do. Read the error code, not the warning page, and confirm with openssl s_client. Never work round a certificate error by turning verification off in a client: that removes the authentication guarantee, so the encryption is to whoever answers.
- Networking
- Security
← → move through sections and cards