What happens in a TLS handshake
- Client (browser) sends its supported TLS versions and ciphers.
- Server picks one, returns its certificate and chain.
- Client verifies the certificate is valid, unexpired, matches the hostname, and chains to a trusted root.
- Both sides derive session keys and the encrypted connection begins.
The five errors you'll actually see
- NET::ERR_CERT_DATE_INVALID — certificate expired (or client clock is wrong).
- NET::ERR_CERT_COMMON_NAME_INVALID — certificate doesn't include the hostname.
- NET::ERR_CERT_AUTHORITY_INVALID — chain is incomplete or signed by an untrusted CA.
- SSL_ERROR_NO_CYPHER_OVERLAP — server only supports ciphers the client refuses.
- ERR_SSL_PROTOCOL_ERROR — handshake aborted, often a TLS version mismatch or middleware intercepting traffic.
Fix-it checklist
- Confirm cert expiry and hostname coverage with an SSL inspection tool.
- Verify the full intermediate chain is served — not just the leaf certificate.
- Disable TLS 1.0 and 1.1; require TLS 1.2 minimum, prefer TLS 1.3.
- Ensure SNI is enabled if you host multiple sites on one IP.
- If a client's clock is wrong (common on embedded devices), validation fails for legitimate certs.
Never get blindsided again
SSL outages are 100% predictable — certificates have an expiry date written into them. Monitor your endpoints with daily checks and renewal alerts. Pro users can schedule SSL inspection across multiple domains and get alerted 30 / 14 / 3 days before expiry.