> Exact TLS certificate errors from curl, OpenSSL, Java, Python, Node.js, npm, Go, .NET, Chrome and Firefox, with the likely causes and safe fixes. Source: https://pkizerotohero.com/errors/ · Last reviewed: 2026-10-20 Error pages # Certificate error messages, explained and fixed 36 of 36 error pages published in this early edition, grouped by the tool that prints them. [Paste your error](https://pkizerotohero.com/tools/error-finder/)[How-to guides](https://pkizerotohero.com/guides/) Paste your error into the [error finder](https://pkizerotohero.com/tools/error-finder/) or pick your tool below. Each page starts with the exact message, shows where it appears with real output, and lists the likely causes, most common first. For every cause you get a safe command to confirm it and a concrete fix: the full chain on nginx, Apache or IIS, a private root in the right trust store, a corrected name, a renewed certificate or a fixed clock. Many different messages come from just a few problems: a missing intermediate, a root the client does not trust, a name that is not in the certificate, or a date outside the validity period. Browsers often hide the first one; command-line tools and libraries do not. We never recommend switching verification off. Where people commonly do it, the page explains why it is a trap and what to do instead. New to certificates? Start with [Certificate chains and path validation](https://pkizerotohero.com/handbook/certificate-chains/). ## Chrome, Edge - [NET::ERR\_CERT\_AUTHORITY\_INVALID](https://pkizerotohero.com/errors/chrome-err-cert-authority-invalid/) - [NET::ERR\_CERT\_COMMON\_NAME\_INVALID](https://pkizerotohero.com/errors/chrome-err-cert-common-name-invalid/) - [NET::ERR\_CERT\_DATE\_INVALID](https://pkizerotohero.com/errors/chrome-err-cert-date-invalid/) - [ERR\_SSL\_PROTOCOL\_ERROR](https://pkizerotohero.com/errors/chrome-err-ssl-protocol-error/) - [ERR\_SSL\_VERSION\_OR\_CIPHER\_MISMATCH](https://pkizerotohero.com/errors/chrome-err-ssl-version-or-cipher-mismatch/) - [NET::ERR\_CERT\_REVOKED](https://pkizerotohero.com/errors/chrome-err-cert-revoked/) ## Firefox - [SEC\_ERROR\_UNKNOWN\_ISSUER](https://pkizerotohero.com/errors/firefox-sec-error-unknown-issuer/) - [SSL\_ERROR\_BAD\_CERT\_DOMAIN](https://pkizerotohero.com/errors/firefox-ssl-error-bad-cert-domain/) - [SEC\_ERROR\_EXPIRED\_CERTIFICATE](https://pkizerotohero.com/errors/firefox-sec-error-expired-certificate/) - [MOZILLA\_PKIX\_ERROR\_SELF\_SIGNED\_CERT](https://pkizerotohero.com/errors/firefox-mozilla-pkix-self-signed-cert/) ## curl - [SSL certificate problem: unable to get local issuer certificate](https://pkizerotohero.com/errors/curl-unable-to-get-local-issuer-certificate/) - [SSL certificate problem: self-signed certificate in certificate chain](https://pkizerotohero.com/errors/curl-self-signed-certificate-in-certificate-chain/) - [curl: (35) … wrong version number](https://pkizerotohero.com/errors/curl-35-ssl-connect-error/) - [curl: (77) error setting certificate verify locations](https://pkizerotohero.com/errors/curl-77-certificate-verify-locations/) ## git on Windows - [schannel: SEC\_E\_UNTRUSTED\_ROOT (0x80090325)](https://pkizerotohero.com/errors/git-schannel-sec-e-untrusted-root/) ## OpenSSL - [verify error:num=20:unable to get local issuer certificate](https://pkizerotohero.com/errors/openssl-verify-error-20/) - [verify error:num=21:unable to verify the first certificate](https://pkizerotohero.com/errors/openssl-verify-error-21/) - [verify error:num=10:certificate has expired](https://pkizerotohero.com/errors/openssl-certificate-has-expired/) - [tlsv1 alert unknown ca](https://pkizerotohero.com/errors/openssl-tlsv1-alert-unknown-ca/) ## Java - [PKIX path building failed … unable to find valid certification path to requested target](https://pkizerotohero.com/errors/java-pkix-path-building-failed/) - [No subject alternative names matching IP address … found](https://pkizerotohero.com/errors/java-no-subject-alternative-names/) - [Received fatal alert: handshake\_failure](https://pkizerotohero.com/errors/java-handshake-failure/) - [CertPathValidatorException: validity check failed](https://pkizerotohero.com/errors/java-certificate-expired/) ## Android - [Trust anchor for certification path not found](https://pkizerotohero.com/errors/android-trust-anchor-not-found/) ## Python - [\[SSL: CERTIFICATE\_VERIFY\_FAILED\] certificate verify failed: unable to get local issuer certificate](https://pkizerotohero.com/errors/python-certificate-verify-failed/) - [certificate verify failed: Hostname mismatch, certificate is not valid for '…'](https://pkizerotohero.com/errors/python-hostname-mismatch/) - [\[SSL: WRONG\_VERSION\_NUMBER\] wrong version number](https://pkizerotohero.com/errors/python-ssl-wrong-version-number/) ## Node.js - [UNABLE\_TO\_VERIFY\_LEAF\_SIGNATURE](https://pkizerotohero.com/errors/node-unable-to-verify-leaf-signature/) - [ERR\_TLS\_CERT\_ALTNAME\_INVALID](https://pkizerotohero.com/errors/node-err-tls-cert-altname-invalid/) - [SELF\_SIGNED\_CERT\_IN\_CHAIN](https://pkizerotohero.com/errors/node-self-signed-cert-in-chain/) - [CERT\_HAS\_EXPIRED](https://pkizerotohero.com/errors/node-cert-has-expired/) ## npm - [UNABLE\_TO\_GET\_ISSUER\_CERT\_LOCALLY](https://pkizerotohero.com/errors/npm-unable-to-get-issuer-cert-locally/) ## Go, Docker, Kubernetes - [x509: certificate signed by unknown authority](https://pkizerotohero.com/errors/go-x509-unknown-authority/) - [x509: certificate has expired or is not yet valid](https://pkizerotohero.com/errors/go-x509-certificate-expired/) ## .NET, PowerShell - [The remote certificate is invalid according to the validation procedure](https://pkizerotohero.com/errors/dotnet-remote-certificate-invalid/) - [Could not establish trust relationship for the SSL/TLS secure channel](https://pkizerotohero.com/errors/powershell-could-not-establish-trust/) Last reviewed 20 October 2026