TLS/SSL negotiation failed

Reference guide

What does the certificate warning actually say, if you can see one?

Certificate has expired

Request path

  1. You (reached)
  2. DNS (reached)
  3. Cloudflare edge (not reached)
  4. Origin (not reached)

certificate expired

The origin's TLS certificate is past its expiration date.

What to do

  1. Check. Inspect the certificate's expiration date for this exact hostname, e.g. in a browser, or with `openssl s_client -connect <hostname>:443 -servername <hostname>`.
  2. Fix. Renew the certificate.
  3. Verify. Reload the site once the certificate is renewed and confirm the warning is gone.

Name doesn't match this domain

Request path

  1. You (reached)
  2. DNS (reached)
  3. Cloudflare edge (not reached)
  4. Origin (not reached)

hostname mismatch

The origin's TLS certificate does not cover this exact hostname.

What to do

  1. Check. Check which hostnames the current certificate actually covers (its Subject Alternative Names), and compare against the exact hostname you're visiting, including www vs. apex and any subdomains.
  2. Fix. Reissue the certificate to cover this exact hostname, including www vs. non-www and any subdomains that need it.
  3. Verify. Reload the site once the corrected certificate is deployed and confirm the warning is gone.

Not trusted / self-signed / unknown authority

Request path

  1. You (reached)
  2. DNS (reached)
  3. Cloudflare edge (not reached)
  4. Origin (not reached)

certificate untrusted

The origin's TLS certificate is self-signed or issued by an authority your browser doesn't trust.

What to do

  1. Check. Confirm which certificate authority issued the current certificate, and whether it's a publicly trusted CA or a self-signed/internal one.
  2. Fix. Replace the certificate with one from a publicly trusted CA. If this is Cloudflare-fronted, also confirm SSL/TLS mode isn't set to 'Full' against a self-signed origin cert without intending 'Full (strict)'.
  3. Verify. Reload the site once the new certificate is deployed and confirm the warning is gone.

No specific message / it just failed to connect

Request path

  1. You (reached)
  2. DNS (reached)
  3. Cloudflare edge (not reached)
  4. Origin (not reached)

handshake fails

The connection failed at the point HTTPS negotiation would occur.

What to do

  1. Check. Inspect the certificate for this exact hostname, e.g. in a browser, or with `openssl s_client -connect <hostname>:443 -servername <hostname>`.
  2. Fix. Renew or reissue the certificate, and confirm it covers this exact hostname, including www vs. non-www and any subdomains.
  3. Verify. Re-run the scan once the certificate is updated.

Want to narrow it down interactively instead? Use the error lookup tool.