Error map
x509 (kubectl) Unable to connect to the server: x509: certificate has expired or is not yet valid / certificate signed by unknown authority
Kubernetes · layer 6, Platform & cloud
Centre: this error. First ring: errors it is linked with (12). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (12)
Error from server (NotFound): deployments.apps "x" not found
The named object doesn’t exist in the namespace/cluster kubectl is pointing at.
kubectl: The connection to the server localhost:8080 was refused — did you specify the right host or port?
kubectl has no usable kubeconfig, so it falls back to localhost:8080 — or the cluster API server is unreachable.
error: You must be logged in to the server (Unauthorized)
The cluster rejected kubectl’s credentials — expired token, wrong kubeconfig user, or cloud IAM identity not allowed.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain)
Cloudflare has no edge certificate for the hostname — the Universal SSL cert is still pending, or the hostname is a second-level…
Cloudflare Error 1013: HTTP hostname and TLS SNI hostname mismatch
The TLS SNI (the hostname used for the certificate) differs from the HTTP Host header in the same request.
Error from server (BadRequest): container "x" in pod "y" is waiting to start: ContainerCreating
kubectl logs has nothing to show yet — the container hasn’t started (still creating, pulling, or blocked).
Unable to connect to the server: dial tcp <ip>:443: i/o timeout
kubectl can’t reach the API server at all — network path, VPN, firewall or a private endpoint you’re outside of.
error: the server doesn't have a resource type "x"
kubectl doesn’t know the resource name you typed — a typo, a CRD that isn’t installed, or a stale discovery cache.
SSL: CERTIFICATE_VERIFY_FAILED / unable to get local issuer certificate
The client couldn’t verify the server’s TLS certificate chain, so it refused the HTTPS connection.
No resources found in default namespace
Not an error: kubectl found nothing of that kind in the namespace it looked in — usually because the resources are in another nam…
Error from server (Forbidden): pods is forbidden: User "x" cannot list resource "pods" in API group "" in the namespace
You’re authenticated to the cluster, but RBAC doesn’t give your user or service account that verb on that resource.
HttpRequestException: The SSL connection could not be established, see inner exception. (AuthenticationException: The remote certificate is invalid)
HttpClient couldn’t complete the TLS handshake — untrusted/self-signed certificate, name mismatch, expired certificate, or TLS ve…
Two steps away (32)
Namespace stuck in Terminating
A deleted namespace never disappears because some resource inside it, or the namespace’s own finalizer, can’t be cleaned up.
Error from server (AlreadyExists): ... already exists
kubectl create tried to make an object whose name is already taken in that namespace.
error: no context exists with the name: "x"
kubectl was told to use a context that isn’t in the loaded kubeconfig file(s).
Error: connect ECONNREFUSED 127.0.0.1:5432
Nothing is listening at that host:port — the target service is down or you’re connecting to the wrong address.
Kubernetes: CrashLoopBackOff
The container starts, crashes (or exits), and Kubernetes keeps restarting it with increasing back-off delays.
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
AADSTS50126: Error validating credentials due to invalid username or password
Microsoft Entra ID (Azure AD) rejected the sign-in because the username or password is wrong — or the flow can’t use passwords fo…
Azure CLI: Please run 'az login' to setup account / No subscription found
The Azure CLI has no signed-in account (or its token expired), or the account has no subscriptions.
DefaultAzureCredential failed to retrieve a token from the included credentials / ManagedIdentityCredential authentication unavailable
The Azure SDK tried every credential source (env vars, workload identity, managed identity, CLI…) and none worked.
Cloudflare Error 525: SSL Handshake Failed
Cloudflare couldn’t complete a TLS handshake with your origin (SSL mode Full / Full strict).
fatal: unable to access 'https://…': SSL certificate problem: unable to get local issuer certificate
Git doesn’t trust the HTTPS server’s certificate — corporate proxy, self-hosted Git with an internal CA, or outdated CA bundle.
javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target
Java doesn’t trust the server’s certificate chain (self-signed, corporate proxy CA, or missing intermediate).
NET::ERR_CERT_AUTHORITY_INVALID (Your connection is not private)
The site’s certificate isn’t signed by a CA the browser trusts — self-signed, missing intermediates, or intercepted by a proxy.
NET::ERR_CERT_DATE_INVALID (certificate expired)
The site’s certificate has expired (or isn’t valid yet) — or the device clock is wrong.
ERR_SSL_PROTOCOL_ERROR (This site can't provide a secure connection)
The browser couldn’t negotiate TLS — the server sent an invalid response, often plain HTTP on the HTTPS port.
HTTP 500 Internal Server Error
The server hit an unexpected condition — usually an unhandled exception or misconfiguration in the application.
HTTP 499 Client Closed Request (Nginx)
Nginx-specific code logged when the client disconnected before the server finished responding.
Kubernetes: CreateContainerConfigError — secret / configmap not found
Kubernetes can’t build the container’s configuration — usually a referenced Secret, ConfigMap or key doesn’t exist in that namesp…
API Request Timed Out (ETIMEDOUT / ReadTimeout / timeout of 30000ms exceeded)
The client gave up waiting — either for the connection to open or for the response to arrive.
Windows Update error 0x8024402C (cannot connect to update server)
Windows Update can’t reach Microsoft’s servers — a proxy, DNS, firewall or WSUS setting is blocking the connection.
Error 0x80072EE7 (Windows Update / Microsoft Store: server name could not be resolved)
Windows can’t resolve Microsoft’s server names — DNS, hosts file, proxy or firewall problems.
no matches for kind "Ingress" in version "extensions/v1beta1" (resource mapping not found)
The manifest uses an apiVersion/kind the cluster doesn’t serve — a removed beta API, or a CRD that isn’t installed.
kubectl: error: executable gke-gcloud-auth-plugin not found — it looks like you are trying to use a client-go credential plugin that is not installed
kubectl needs the `gke-gcloud-auth-plugin` binary to authenticate to GKE, and it is missing from PATH.
HTTP 502 Bad Gateway
A proxy or gateway (Nginx, load balancer, CDN) got an invalid response — or no response — from the upstream server behind it.
TypeError: Failed to fetch / NetworkError when attempting to fetch resource
The browser couldn’t complete the request at the network level — CORS, DNS, offline, blocked mixed content, or the server refused…
Cloudflare Error 520: Web Server Returned an Unknown Error
Cloudflare connected to your origin, but the origin returned an empty, unknown or invalid response.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
Azure: AuthorizationFailed — The client does not have authorization to perform action
The signed-in identity (user, service principal or managed identity) lacks an Azure RBAC role for that action on that scope.
Azure Storage: AuthorizationPermissionMismatch (403) — This request is not authorized to perform this operation using this permission
You’re accessing blob/queue data with Microsoft Entra ID, but the identity has only management roles (Owner/Contributor) — not a…
Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames
The server’s certificate doesn’t cover the hostname you connected to.
npm ERR! code SELF_SIGNED_CERT_IN_CHAIN — request to https://registry.npmjs.org/ failed, reason: self signed certificate in certificate chain
A corporate proxy or antivirus is intercepting HTTPS, and npm doesn’t trust its certificate.
npm ERR! code UNABLE_TO_GET_ISSUER_CERT_LOCALLY
npm can’t verify the registry’s certificate chain — missing intermediate or intercepted connection.
Map another error
Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError