Recommended Free Tools
A certificate working in a browser does not prove that your application or service trusts it. The service may use a different certificate authority (CA) store, connect to a different hostname, or receive a chain that it cannot validate. Start by capturing the exact error from the service, then check its destination hostname, trust store, and the certificate chain it actually receives.
Why browser success does not settle the service’s error
TLS certificate validation checks both whether the certificate chains to a trusted authority and whether it is valid for the hostname the client requested. Browsers and services can use different TLS libraries and trust stores, so they may reach different results for the same site. A browser may also visit a different hostname from the one configured in a service request.
As an Amazon Associate I earn from qualifying purchases.
As the curl project’s certificate-verification documentation explains, curl verifies certificates by default. Its trust configuration can depend on how it was built; some builds use a native store, while others use CA files or directories. A service’s runtime, host, or container—not the browser’s successful connection—is the environment to investigate.
Identify which validation check is failing
Several causes can produce a certificate error, and more than one may be present at once. The error and the chain presented to the failing client help narrow it down.
#1 Best Overall
| Possible cause | What to check |
|---|---|
| Hostname mismatch | Compare the exact hostname in the service’s request with the names on the certificate. Redirects or different configured URLs can mean the browser and service are validating different names. |
| Untrusted issuer or missing trust anchor | Check whether the service’s active trust store contains a current, trusted root CA. An issuer error alone does not establish whether the server omitted an intermediate or the client lacks a usable trust store. |
| Missing intermediate certificate | Inspect the chain the server sends to the service. A client may fail to build a path to a trusted root if a required intermediate is not provided. |
| Expired certificate | Check the certificate’s validity period and the verification result for the connection. |
The OpenSSL TLS Client Block guide describes hostname mismatch, untrusted CAs, missing intermediates, and expiration as distinct verification problems.
Troubleshoot from the service’s environment
- Capture the complete failure. Record the full TLS exception or verification message, the runtime and version, the process or container environment, and the URL and hostname actually used. The phrase “certificate failed” is not enough to identify the cause.
- Verify the requested hostname. Compare the hostname in the service’s request with the certificate’s names. Check for redirects or configuration differences that could make the service connect under another name.
- Find the trust store the service uses. Identify its TLS library or backend and whether it reads a platform-native store, a CA bundle, or a configured CA directory. Confirm the expected root CA is present and current. OpenSSL describes the role of a trusted certificate store in its TLS Introduction.
- Inspect the chain received by the service. Check whether the server sends the required intermediate certificates and whether it presents a different chain to this connection. The Apache SSL/TLS FAQ discusses intermediate-chain delivery and SNI, which can affect which certificate a server presents.
- Check validity and issuer details. Confirm the certificate is within its validity period and inspect the issuer and verification output. An “unable to get local issuer certificate” error can be consistent with a missing intermediate or an absent or unusable trust store; it does not by itself distinguish between them.
- Reproduce the connection in the same environment. Run verbose curl or OpenSSL’s
s_clientfrom the service host or container, using the same hostname and, where possible, the same CA configuration. OpenSSL documentss_clientas a diagnostic tool; it can continue after a verification error unless configured to return that error. See the OpenSSL s_client documentation. - Correct the underlying cause. Serve the required chain, configure or update the service’s trust store, or correct the hostname or certificate. Keep peer verification enabled in production.
Why disabling verification is not a fix
Turning off certificate verification may make a request proceed, but it also removes an important check that the service is talking to the intended server. That can expose the connection to a man-in-the-middle attack. The curl project explains the risk in its guide to verifying server certificates. Use a temporary diagnostic change only in a controlled test when appropriate, never as the production remedy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the error can—and cannot—tell you
A browser’s success and the service’s failure are compatible: they may differ in trust configuration, hostname, or the chain they can build. The service’s own error, runtime configuration, and observed connection are needed to determine which check failed. Without the exact runtime, hostname, error, and presented chain, there is no basis to name one root cause for a particular incident.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
