tls-debugginglisted

# TLS Debugging Read the actual certificate the server presents, and compare it against what the client requires. ## Purpose **Use this when:** - `x509: certificate has expired`, `certificate signed by unknown authority`, `SSL certificate problem: unable to get local issuer certificate`. - `x509: certificate is valid for X, not Y`. - `handshake failure`, `no shared cipher`, `protocol version`. - HTTPS works in a browser but fails from an application, or works from one client and not another. - A mutual-TLS connection is rejected. **Do not use this when:** - The name does not resolve — use `dns-troubleshooting`. - The handshake succeeds and the HTTP response is wrong — use `http-debugging`. **What this skill assumes:** `openssl s_client`, and network reachability to the server. If the TCP connection itself fails, this is not a TLS problem. ## Operating Procedure 1. **Get the exact error.** TLS errors are precise and each points at a distinct cause. 2. **Fetch the certificate the server actually presents**, with the correct SNI. What is deployed is frequently not what someone believes is deployed. 3. **Check the four things in order**: validity dates, hostname/SAN, chain completeness, trust. 4. **Compare client requirements**: protocol version, ciphers, trust store. 5. **Check the clock on both ends.** Skew produces "expired" and "not yet valid" errors on perfectly good certificates. 6. **Fix and verify** from the client that failed, not from your laptop. The