How do you debug a "TLS handshake failed" error?
⚡
Quick Answer
The TLS negotiation broke — usually an expired/invalid certificate, a hostname/SAN mismatch, an untrusted CA, or a protocol/cipher mismatch. Inspect the cert and handshake with openssl s_client.
Detailed Answer
openssl s_client -connect host:443 -servername host shows the presented chain, expiry, and negotiated protocol. Check: cert not expired, CN/SAN matches the hostname, the full chain (including intermediates) is served, the client trusts the issuing CA, and client/server share a TLS version and cipher. Renew or fix the chain, or update the trust store as appropriate.
Code Example
openssl s_client -connect host:443 -servername host
💡
Interview Tip
Lead with openssl s_client and the four usual causes: expiry, SAN mismatch, missing intermediate, untrusted CA.
tlssslcertificatestroubleshooting