TLS/SSL negotiation failed
What does the certificate warning actually say, if you can see one?
Certificate has expired
The origin's TLS certificate is past its expiration date.
Check
Inspect the certificate's expiration date for this exact hostname, e.g. in a browser, or with `openssl s_client -connect <hostname>:443 -servername <hostname>`.
Fix
Renew the certificate.
Verify
Reload the site once the certificate is renewed and confirm the warning is gone.
Name doesn't match this domain
The origin's TLS certificate does not cover this exact hostname.
Check
Check which hostnames the current certificate actually covers (its Subject Alternative Names), and compare against the exact hostname you're visiting, including www vs. apex and any subdomains.
Fix
Reissue the certificate to cover this exact hostname, including www vs. non-www and any subdomains that need it.
Verify
Reload the site once the corrected certificate is deployed and confirm the warning is gone.
Not trusted / self-signed / unknown authority
The origin's TLS certificate is self-signed or issued by an authority your browser doesn't trust.
Check
Confirm which certificate authority issued the current certificate, and whether it's a publicly trusted CA or a self-signed/internal one.
Fix
Replace the certificate with one from a publicly trusted CA. If this is Cloudflare-fronted, also confirm SSL/TLS mode isn't set to 'Full' against a self-signed origin cert without intending 'Full (strict)'.
Verify
Reload the site once the new certificate is deployed and confirm the warning is gone.
No specific message / it just failed to connect
The connection failed at the point HTTPS negotiation would occur.
Check
Inspect the certificate for this exact hostname, e.g. in a browser, or with `openssl s_client -connect <hostname>:443 -servername <hostname>`.
Fix
Renew or reissue the certificate, and confirm it covers this exact hostname, including www vs. non-www and any subdomains.
Verify
Re-run the scan once the certificate is updated.
Want to narrow it down interactively instead? Use the error lookup tool.