PRINTABLE FIELD NOTES
TLS troubleshooting
Use this before an interview or during a focused review.
TLS troubleshooting
Test the intended hostname. Connecting to an IP without the right SNI can test a different virtual host.
| 1. Identify the boundary | Browser-to-edge and edge-to-origin sessions can fail independently. |
|---|---|
| 2. Inspect certificate identity | Check SAN covers the requested hostname and that expiry and chain trust are valid. |
| 3. Match negotiation | Inspect SNI, supported protocols and ciphers; account for mTLS if configured. |
| 4. Compare HTTP routing | After TLS succeeds, Host, path and application routing still can be wrong. |
| 5. Restore safely | Fix the certificate or trust configuration; avoid masking errors by disabling validation. |
| Useful command | openssl s_client -connect example.test:443 -servername example.test -verify_hostname example.test -verify_return_error -showcerts SNI selects the server name; -verify_hostname checks certificate identity and -verify_return_error stops on verification failure. Replace example.test with an authorized host. A private test CA must be explicitly trusted, for example with -CAfile test-ca.pem. |