TLS handshake failed (certificate error)

What it usually means

The connection opened but the certificate handshake failed. Usually an expired or self-signed certificate, an incomplete chain, or a hostname that does not match the certificate.

What to check first

• The certificate has not expired: an expired certificate is the usual reason, and an SSL monitor warns weeks ahead.
• The certificate matches the hostname the monitor uses (www and non-www are different names).
• The full chain is served, including the intermediate certificate; browsers tolerate a missing one, strict clients do not.
• The server still offers a TLS version and cipher a modern client accepts.

How ErrorDetector reports it

This is a reachability failure. The check is repeated immediately to rule out a blip; once confirmed, an incident opens with this cause on it, every channel on the monitor is alerted, and the outage counts against uptime until the next successful check closes the incident.

Caught by: httpkeywordapissl monitors. Read about the ssl monitoring feature.