Error map
The following certs could not be renewed Certbot: Failed to renew certificate example.com with error — The following certs could not be renewed: /etc/letsencrypt/live/example.com/fullchain.pem (failure)
SSL / TLS · layer 2, Network
Centre: this error. First ring: errors it is linked with (10). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (10)
Let’s Encrypt / Certbot: Challenge failed for domain example.com — Invalid response from http://example.com/.well-known/acme-challenge/x: 404
Let’s Encrypt couldn’t verify you control the domain — the HTTP-01 challenge file wasn’t served, or DNS points elsewhere.
NET::ERR_CERT_DATE_INVALID (certificate expired)
The site’s certificate has expired (or isn’t valid yet) — or the device clock is wrong.
Old clients: certificate has expired — Let's Encrypt chain uses expired DST Root CA X3 (OpenSSL 1.0.x, Android < 7.1.1)
Older systems fail to validate Let's Encrypt certificates because their trust store lacks ISRG Root X1 and relies on the expired…
Certbot: Detail: DNS problem: NXDOMAIN looking up A for www.example.com - check that a DNS record exists for this domain
Let's Encrypt could not resolve the domain you asked a certificate for; no A/AAAA record exists.
Certbot: Problem binding to port 80: Could not bind to IPv4 or IPv6 (standalone authenticator)
`certbot --standalone` needs to listen on port 80 for the HTTP-01 challenge but another process (Nginx, Apache) already holds it.
OpenSSL: verify error:num=10:certificate has expired — notAfter=Jan 1 00:00:00 2025 GMT
OpenSSL's verification found a certificate in the chain whose validity period has ended.
Let's Encrypt: urn:ietf:params:acme:error:rateLimited :: too many certificates (5) already issued for this exact set of identifiers in the last 168 hours
You hit a Let's Encrypt rate limit — too many certificates, failed validations or new orders in a period.
Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem)
The ACME validation server could not reach your server on port 80 within the timeout.
Certbot: Could not automatically find a matching server block for example.com. Set the `server_name` directive to use the Nginx installer
Certbot's Nginx plugin could not find a `server` block whose `server_name` matches the domain you requested.
Certbot: Detail: Invalid response from http://example.com/.well-known/acme-challenge/abc: 404
Let's Encrypt reached your server but the challenge file was not found at `/.well-known/acme-challenge/`, so the web server retur…
Two steps away (24)
Cloudflare Error 526: Invalid SSL Certificate
With SSL mode Full (strict), the origin’s certificate is expired, self-signed, or doesn’t match the hostname.
Provisioning profile "x" doesn't include signing certificate "Apple Development: Name (ID)"
The profile was created with a different certificate than the one installed in your keychain.
NET::ERR_CERT_COMMON_NAME_INVALID: Your connection is not private (certificate is for a different domain)
The certificate presented doesn’t include the hostname you visited — e.g. visiting www.example.com with a certificate only for ex…
javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target
Java doesn’t trust the server’s certificate chain (self-signed, corporate proxy CA, or missing intermediate).
QuotaExceededError: Failed to execute 'setItem' on 'Storage': Setting the value exceeded the quota
localStorage/sessionStorage is full (about 5 MB per origin) or storage is disabled.
NotAllowedError: play() failed because the user didn't interact with the document first.
The browser blocked media autoplay with sound until the user interacts with the page.
Firefox: Peer's Certificate has expired. Error code: SEC_ERROR_EXPIRED_CERTIFICATE
Firefox found an expired certificate in the chain presented by the server.
OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED
The client could not build a chain from the server's certificate to a CA it trusts — the issuer is missing locally or the server…
sudo: unable to resolve host <hostname>: Name or service not known
The machine’s hostname isn’t in /etc/hosts (or DNS), so sudo prints this warning — usually after changing the hostname.
ping: google.com: Temporary failure in name resolution
The Linux host can’t resolve domain names — no working DNS server is configured or reachable.
Cloudflare Error 523: Origin is unreachable
Cloudflare can’t find a network route to your origin server — the DNS record points to a wrong/unroutable IP or the origin networ…
Certbot: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.example.com / Incorrect TXT record
The DNS-01 challenge could not find (or found the wrong) `_acme-challenge` TXT record for the domain, so the wildcard or DNS vali…
Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name
Apache's SSL virtual host name does not match any name inside the certificate it loads.
Error: error:0308010C:digital envelope routines::unsupported
An old build tool (webpack 4, old react-scripts) uses a hash algorithm that OpenSSL 3 in Node 17+ disables.
OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch)
OpenSSL (or Nginx/Apache) couldn’t read the certificate or key — wrong file format, wrong file, or the key doesn’t match the cert…
OpenSSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number
The peer did not answer with a TLS record — you spoke TLS to a plain HTTP/SMTP port (or the reverse), or a proxy intervened.
Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty
Apache cannot find the certificate or key file named in its configuration, or `SSLEngine on` is set without any certificate.
Cloudflare Error 1020: Access Denied
A Cloudflare firewall/WAF custom rule blocked the request — the visitor’s IP, country, user agent or request pattern matched a bl…
ssh: connect to host x port 22: Connection timed out
SSH packets get no reply — a firewall/security group drops them, the server is off, or the IP is wrong.
connect: No route to host (EHOSTUNREACH)
The destination host isn’t reachable — it’s down, on another subnet without routing, or a firewall rejects with “host unreachable…
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
Nginx (or another server) can’t listen on the port because another process already holds it — often Apache, another Nginx, or a s…
Nginx: upstream timed out (110: Connection timed out) while reading response header from upstream
Nginx waited longer than proxy_read_timeout (60 s default) for the backend (app server, PHP-FPM) to respond, then returned 504.
Nginx: nginx: [emerg] unknown directive "x" in /etc/nginx/sites-enabled/x:12 — configuration file test failed
Nginx found a directive it doesn’t know — a typo, a missing semicolon on the previous line, a directive from a module that isn’t…
Let's Encrypt/CA: CAA record for example.com prevents issuance
The domain's DNS CAA records do not list the certificate authority you asked, so the CA must refuse.
Map another error
Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError