Certificate Failure Scenarios: Complete Troubleshooting Guide

Expired Certificates

The most common certificate failure. Every certificate has a validity period (typically 90 days to 1 year). When this period ends, browsers reject the certificate completely.

What Users See

How to Check Expiration

# Check certificate expiration date
openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -dates

# Output:
# notBefore=Jan  1 00:00:00 2024 GMT
# notAfter=Apr  1 00:00:00 2024 GMT

Prevention

Revoked Certificates

Revocation occurs when a certificate is invalidated before its expiration date, usually due to key compromise, mis-issuance, or because the certificate is no longer needed.

Reasons for Revocation

How Browsers Check Revocation

Browsers use CRL (Certificate Revocation Lists) or OCSP (Online Certificate Status Protocol) to check if a certificate has been revoked. OCSP Stapling is the modern, efficient approach.

# Check OCSP status
openssl s_client -connect example.com:443 -status 2>/dev/null | \
  grep -A 5 "OCSP Response"

# Check CRL
openssl x509 -in cert.pem -noout -text | grep -A 2 "CRL Distribution"

Certificate Name Mismatch

This error occurs when the domain you're visiting doesn't match any name in the certificate's Common Name (CN) or Subject Alternative Names (SANs).

Common Causes

Check Certificate Names

# View all names in certificate
openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -text | \
  grep -A 1 "Subject Alternative Name"

# Output:
# X509v3 Subject Alternative Name:
#     DNS:example.com, DNS:www.example.com, DNS:api.example.com

Chain Validation Failures

Certificate chain errors occur when the browser cannot build a trust path from your certificate to a trusted Root CA.

Common Chain Errors

Verify Certificate Chain

# Check full certificate chain
openssl s_client -connect example.com:443 -showcerts 2>/dev/null | \
  grep -E "(Certificate chain|s:|i:)"

# Verify chain is complete
openssl verify -CAfile ca-bundle.crt -untrusted intermediate.crt server.crt

Man-in-the-Middle (MITM) Attacks

In a MITM attack, an attacker intercepts traffic and presents their own certificate. If successful, they can read and modify all encrypted traffic.

How MITM Works

Protections

Self-Signed Certificate Errors

Self-signed certificates are not signed by a trusted CA. They're useful for testing but should never be used in production for public-facing services.

When Self-Signed Is Acceptable

Generate Self-Signed for Testing

# Generate self-signed certificate (for testing only!)
openssl req -x509 -newkey rsa:4096 \
  -keyout key.pem -out cert.pem \
  -days 365 -nodes \
  -subj "/CN=localhost"

Troubleshooting Commands

Essential OpenSSL commands for diagnosing certificate problems.

# Complete TLS connection with verbose output
openssl s_client -connect example.com:443 \
  -servername example.com -status -tlsextdebug

# Download and examine certificate
echo | openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -text

# Test TLS 1.2 specifically
openssl s_client -connect example.com:443 -tls1_2

# Test TLS 1.3 specifically  
openssl s_client -connect example.com:443 -tls1_3

Frequently Asked Questions