An SSL error means the browser tried to establish an encrypted connection and something in the TLS handshake or certificate validation failed. The error pages look alike, but underneath there are only about seven distinct failures. Identify which one you have and the fix is usually mechanical.
The Seven Failures#
| Failure | Typical browser code | Whose fault |
|---|---|---|
| Expired certificate | NET::ERR_CERT_DATE_INVALID | Server (renewal lapsed) |
| Name mismatch | NET::ERR_CERT_COMMON_NAME_INVALID | Server (cert covers wrong hostname) |
| Incomplete chain | unable to get local issuer certificate | Server (missing intermediates) |
| Untrusted issuer / self-signed | NET::ERR_CERT_AUTHORITY_INVALID | Server, or expected (internal tools) |
| Protocol/cipher mismatch | ERR_SSL_PROTOCOL_ERROR, ERR_SSL_VERSION_OR_CIPHER_MISMATCH | Server (legacy TLS config) |
| Clock skew | NET::ERR_CERT_DATE_INVALID on every site | Visitor (system clock wrong) |
| Mixed content | Padlock warning, blocked assets | Site (HTTP assets on an HTTPS page) |
How to Tell Which One You Have#
Read the actual code, not the scary page. Chrome's "Advanced" link and Firefox's error details name the specific failure; the SSL error decoder translates any code you do not recognize, and the SSL error reference has a fix card per code.
Check scope. Every HTTPS site failing on one machine means that machine's clock or its antivirus proxy. One site failing everywhere means that site's certificate or config.
Inspect from the command line:
openssl s_client -connect example.com:443 -servername example.com
openssl s_client -connect example.com:443 -servername example.com
The output names the certificate, its dates, the chain that was served, and the verify result; one command distinguishes five of the seven failures.
The Fixes, Briefly#
- Expired cert: renew, and automate renewal (ACME/Certbot) so it cannot recur silently.
- Name mismatch: issue a certificate covering the exact hostname; remember wildcards cover one level only.
- Incomplete chain: serve
fullchain.pem, not the bare leaf; full walkthrough in the certificate chain guide. - Self-signed in production: replace with a CA-issued certificate; free via Let's Encrypt.
- Protocol mismatch: enable TLS 1.2/1.3; details in the ERR_SSL_VERSION_OR_CIPHER_MISMATCH fix.
- Clock skew: enable automatic time sync on the affected device.
- Mixed content: load every script, image, and stylesheet over HTTPS;
Content-Security-Policy: upgrade-insecure-requestscleans up the long tail.
Why SSL Errors Are Worse Than Downtime#
A 500 page costs you the visit. An SSL warning costs you the visit plus trust: the browser tells the user, in red, that the site may be stealing their data, and "Proceed anyway" is hidden behind a warning most users will never click through. For commerce sites the session is simply over. Treat certificate and TLS health as part of uptime, not as a side detail.
Limitations to Know#
- Some causes are outside your reach. Visitor-side clocks, corporate TLS-interception proxies, and ancient devices produce errors your config cannot prevent.
- Browser codes are not perfectly consistent. The same server bug can surface under different codes across browsers (the plaintext-on-443 bug appears as
ERR_SSL_PROTOCOL_ERRORin Chrome and SSL_ERROR_RX_RECORD_TOO_LONG in Firefox).
Conclusion#
SSL errors come from a short list: certificate problems (expired, wrong name, broken chain, untrusted), configuration problems (legacy protocols, plaintext on 443), or client problems (clock, interception). The browser's detailed code plus one openssl command identifies the case; the fixes are routine once named.
The expensive part is the time between the failure starting and you noticing, because your own browser, with its cached sessions and lenient defaults, is often the last to see it. ObserveOne hits your HTTPS endpoints from outside on a schedule and alerts on the first failed connection, which turns a weekend of red warning pages into a five-minute fix.