certificate verify failed

What was verified

openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | grep -A2 'Verify return code'

Names actually present in the certificate

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -ext subjectAltName

Does it expire soon

openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

Self-signed versus wrong name

Verify return code 18 is self-signed, 10 is a name mismatch. They have different causes and different fixes.

On a proxied host the certificate you see locally is the one the proxy serves. Check the name the client connects with, not the one on the certificate.

Scope: failure mode: TLS errors, and which hostname was actually checked.

CliHelper documents failure modes of third-party command line tools. No software is stored or distributed here.

Terms Privacy Contact support@clihelper.pro