Free tools Windows power users keep installed
One-click scans. No signup required.
An SSL/TLS handshake fails when a client and server cannot complete the negotiation needed to create a trusted HTTPS connection. The usual causes are an expired or mismatched certificate, an incomplete certificate chain, incorrect SNI or virtual-host routing, incompatible TLS versions or cipher suites, or a proxy/CDN failing on its separate connection to the origin.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Fix the error by identifying which connection leg fails, testing it with an SNI-aware OpenSSL command, then correcting the certificate, server binding, TLS policy, or proxy path responsible. Do not solve a compatibility problem by permanently enabling obsolete protocols.
As an Amazon Associate I earn from qualifying purchases.
What an SSL handshake does—and what “failed” tells you
HTTPS starts with a TLS handshake before application data is exchanged. The client indicates the hostname it wants, offers supported protocol versions and cipher suites, and validates the certificate returned by the server. The server selects compatible parameters, presents its certificate chain, and proves possession of the corresponding private key. Both sides then derive session keys and begin encrypted HTTP traffic.
A failure means that one of those decisions could not be completed. The message does not, by itself, identify the cause. A browser may report an invalid certificate, an unsupported protocol, or a reset connection; a CDN may show a provider-specific code; an API client may simply report “handshake failure.” Treat the exact text, timestamp, hostname and port as diagnostic data rather than as the diagnosis.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
There may be two independent handshakes. With a reverse proxy, CDN or tunnel, the browser negotiates TLS with the edge service and the edge negotiates a second TLS connection with your origin. HTTPS can therefore work when you connect directly to the server while failing through the proxy, or the reverse may occur.
First determine which connection is failing
Before changing configuration, establish the failing leg. Record the hostname exactly as the user enters it, the port, the client or browser, the UTC time, and whether the test was direct to the origin address or passed through a proxy. If the error is intermittent, record a successful and failed attempt for comparison.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →| Observed symptom | Most likely failing leg | First check |
|---|---|---|
| Direct access to the origin fails | Client-to-origin TLS | Certificate, SNI-selected virtual host, TLS versions and cipher overlap |
| Direct access works, but the CDN or reverse-proxy hostname fails | Edge-to-origin TLS, or proxy routing | Origin hostname coverage, origin certificate validation, encryption mode and proxy DNS state |
| Only one hostname on a shared IP fails | SNI or name-based virtual-host selection | The requested name, server_name or Apache virtual host, and the certificate served for that name |
| Only an older client or Java application fails | Protocol, cipher or key-exchange compatibility | Client-supported TLS versions, cipher ordering and Diffie-Hellman parameters |
| Failures begin immediately after a certificate or TLS-policy change | Origin configuration or deployment | Active certificate files, private-key match, chain and effective TLS settings |
When the cause remains unclear, a packet capture taken on the affected leg can show whether the connection is being reset by the server, a proxy, or another network device. Capture only under an approved security and privacy process, and protect any resulting files.
Run an SNI-aware handshake test
Use a controlled machine with OpenSSL and test the public hostname, not merely its IP address:
openssl s_client -connect example.com:443 -servername example.com -showcertsThe -servername option sends the TLS Server Name Indication (SNI) value. This is essential when several HTTPS names share one IP address; without it, the server may select a default certificate and virtual host that do not belong to the requested domain. Test the same hostname users report, and repeat the command against the origin endpoint when a proxy is involved.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
How to read the result
- Review the certificates printed after the handshake. Check the subject and Subject Alternative Name entries for the requested hostname, the validity dates, and whether intermediate certificates are included.
- Note the negotiated protocol and cipher. A completed handshake with an unexpected certificate often indicates SNI or virtual-host routing rather than a cryptographic failure.
- Look for verification errors and the final verification status. A chain that cannot be built to a trusted issuer usually means an omitted intermediate, an untrusted issuer, or a client trust-store problem.
- If OpenSSL reports that no protocol or cipher can be selected, compare the client offer with the server’s minimum TLS version and cipher policy.
- Use the output as a point-in-time observation. A load balancer with multiple backends can serve different certificates or policies, so test repeatedly or test each backend deliberately.
Run the command from more than one network when a firewall, TLS-inspection appliance or tunnel may be involved. A device that intercepts TLS can terminate the original session and create a second one, introducing its own certificate and compatibility requirements.
Fix certificate validity, hostname and chain problems
Certificate errors are the most common first-line checks. Confirm all of the following for the certificate actually served on the failing leg:
- It is active. A newly issued certificate may not yet be deployed or active on every endpoint. Confirm the server or edge is using the new file, then reload the service.
- It is within its validity period. An expired certificate is not trusted by a client, so the TLS handshake cannot proceed. Check the “Not Before” and “Not After” dates using the OpenSSL output and the server’s clock.
- It covers the exact hostname. The name must appear in the certificate’s Subject Alternative Name list. A certificate for
www.example.comdoes not automatically coverapi.example.com, and a basic wildcard or single-name certificate may not cover a multi-level subdomain. - The private key matches. The certificate and key configured in the HTTPS listener must be a pair. A mismatch prevents the server from proving possession of the key during the handshake.
- The chain is complete. Serve the required intermediate certificates in addition to the leaf certificate. Some clients can fetch an intermediate from elsewhere, but relying on that behavior produces inconsistent failures.
- The issuer is trusted by the client. Private or newly created certificate authorities require their root certificate in the client trust store. Publicly trusted certificates still fail on clients with obsolete or damaged trust stores.
Deploy the corrected certificate safely
- Identify the certificate file selected by the affected HTTPS listener and compare it with the certificate you intend to use.
- Install the leaf certificate and the complete intermediate chain in the format required by your web server or proxy.
- Install the matching private key with permissions that allow the service to read it but prevent ordinary users from reading it.
- Validate the configuration before reloading the service. A syntax or key error can take the listener offline.
- Reload rather than abruptly stopping the server where supported, then rerun the SNI-aware OpenSSL command.
- Test the public hostname through every proxy, load balancer and origin address that can receive traffic.
Do not assume that renewing a certificate on the origin updates a CDN or tunnel automatically. The edge may have its own certificate and may separately validate the origin certificate.
Correct SNI and virtual-host selection
SNI allows a browser to pass the requested server name during the handshake. The server uses that name to choose a certificate and HTTPS virtual host. If the name is missing, misspelled, or mapped to the wrong listener, a valid certificate can still appear invalid to the client.
NGINX checks
Inspect the HTTPS server block selected for the hostname. Verify that its listen directive enables the intended TLS port, its server_name matches the requested name, and its certificate directives point to the correct files:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
listen 443 ssl;
server_name example.com;
ssl_certificate /path/to/full-chain.pem;
ssl_certificate_key /path/to/private-key.pem;The paths above are illustrative configuration values; use the files and names installed on your server. Check for another HTTPS block that matches first and unintentionally becomes the default. After correcting the configuration, run the server’s configuration test, reload NGINX, and verify the certificate with the OpenSSL command.
Apache checks
Inspect the name-based HTTPS virtual host selected for the requested hostname and its mod_ssl settings. Confirm the virtual host’s name, SSLCertificateFile, chain configuration, private key and cipher policy. A certificate installed in one virtual host does not fix a request routed to another. Check the active configuration rather than only an unused site file, then reload Apache and retest.
For either server, make sure DNS points the hostname to the endpoint whose certificate you are inspecting. A stale record, an IPv6 address with different configuration, or a load balancer backend can make a correct local change appear ineffective.
Make TLS versions and cipher suites overlap
The client and server must share at least one supported TLS protocol version and cipher suite. If you raise the server’s minimum TLS version or restrict ciphers too aggressively, older clients may have no common choice. Conversely, a client that supports only obsolete protocols cannot connect to a server configured securely to reject them.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Diagnose a no-overlap failure
- Use the OpenSSL test output to see whether a protocol and cipher were negotiated at all.
- Compare the server’s effective minimum and maximum TLS versions with those supported by the affected client or library.
- Review the configured cipher policy and ordering. A policy that removes every cipher offered by a particular client produces a handshake failure.
- Check whether a proxy, load balancer or TLS-inspection device applies a different policy from the origin.
- Change one setting at a time, reload the service, and test with both a current client and the client that originally failed.
Prefer upgrading the client, web server and TLS library, or selecting a compatible modern policy. Do not re-enable obsolete protocols as a permanent workaround; they weaken the endpoint for every client. If a legacy application cannot be upgraded immediately, isolate it behind a narrowly scoped compatibility endpoint and document the risk rather than weakening the main site.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Resolve proxy, CDN and tunnel failures
A proxy introduces a second certificate check and a second TLS negotiation. Cloudflare labels an edge-to-origin handshake failure as Error 525. That code means the edge could not complete TLS with the origin; it does not necessarily mean that the browser-to-edge certificate is wrong.
When direct HTTPS works but the proxied hostname fails
- Verify that the proxy’s DNS record resolves to the intended origin address and that the origin accepts connections from the proxy on the configured port.
- Confirm that the origin certificate is active, unexpired, covers the hostname the edge uses, and includes the required intermediate chain.
- Check whether the proxy connects using the public hostname, an origin hostname, or a separately configured name. The certificate must cover the name used during that origin handshake.
- Review the proxy’s encryption mode and origin-certificate validation settings. The selected mode must match what the origin actually presents; strict validation will reject an invalid chain or hostname.
- Inspect origin logs and firewall events at the exact failure time. A firewall that drops or resets proxy connections can look like a TLS error.
When the origin works through the proxy but direct access fails
Check the direct endpoint’s certificate and SNI mapping separately. The proxy may be sending the correct SNI while a direct IP test sends none, or the proxy may terminate TLS with a different certificate. Always test by hostname and use the origin’s intended port.
Tunnels and TLS-inspection appliances have the same split-path behavior. Determine which device terminates each leg, install the appropriate trust chain on that device, and ensure it does not rewrite the hostname or restrict protocols beyond the capabilities of the next peer.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsInvestigate software-specific compatibility
Some clients fail because of implementation details rather than the site’s public certificate. Apache documents Java-client failures associated with incompatible Diffie-Hellman parameters. If a Java application fails while modern browsers succeed, review the server’s cipher ordering and DH parameters, along with the Java runtime’s supported key-exchange groups and TLS versions.
Update the web server, TLS library and client runtime where practical. Then retest from the same runtime that reported the failure. A successful browser test is not proof that an API client, embedded device or older runtime can negotiate the same parameters.
Check server logs at the handshake timestamp. Messages about an unknown protocol, no shared cipher, an unrecognized name, a bad certificate, or a key-exchange failure narrow the search considerably. Correlate those messages with proxy and load-balancer logs so that you do not fix the wrong endpoint.
Verify every change and prevent recurrence
After applying a fix, verify the complete path instead of stopping when one browser loads the page:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Run
openssl s_client -connect example.com:443 -servername example.com -showcertsagainst the affected hostname. - Confirm the returned certificate’s hostname, validity dates, chain and private-key pairing.
- Record the negotiated TLS version and cipher and confirm they meet your security policy.
- Test direct-to-origin and through the CDN, reverse proxy or tunnel, if present.
- Test representative clients, including the application or runtime that originally failed.
- Review web-server, proxy and firewall logs for new handshake errors after the reload.
Set monitoring for certificate expiry, endpoint availability and certificate-name changes. Alert early enough to renew and deploy a certificate across every edge and origin. Include IPv4 and IPv6 endpoints, alternate hostnames and each load-balancer backend in the monitoring plan.
A compact decision path
| OpenSSL or client result | Likely action |
|---|---|
| Certificate is expired or not yet active | Deploy an active certificate and reload the endpoint; verify the server clock. |
| Certificate name does not match | Install a certificate covering the requested hostname or correct the SNI/virtual-host routing. |
| Chain verification fails | Serve the required intermediate certificates and verify client trust. |
| Wrong certificate appears on a shared IP | Correct SNI handling, server_name or Apache virtual-host selection. |
| No shared protocol or cipher | Align modern TLS versions and cipher policy; upgrade the incompatible client or library. |
| Direct origin succeeds but proxy reports 525 | Fix the edge-to-origin hostname, certificate validation, encryption mode, routing or firewall path. |
| Only a Java client fails | Review cipher ordering and Diffie-Hellman parameters, then update the Java runtime or server TLS stack. |
Security cautions
- Do not disable certificate validation in a production client to hide a hostname, expiry or chain problem.
- Do not replace a correct certificate with a self-signed one merely to make a test pass; install trust correctly or use a publicly trusted certificate appropriate for the hostname.
- Do not enable obsolete TLS versions or weak ciphers globally. If a legacy dependency cannot be upgraded, isolate it and set a retirement date.
- Protect private keys, packet captures and verbose TLS logs because they can reveal sensitive connection metadata.
- Make configuration changes reversible and keep a record of which endpoint, listener and backend was changed.
The reliable repair is the one that restores a valid certificate and complete chain, selects the right SNI virtual host, provides a modern overlapping TLS policy, and fixes every proxy-to-origin leg. Once the same hostname succeeds in an SNI-aware handshake test from representative clients, the server is no longer guessing which certificate or protocol to use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
