networking ssl_tls ai_generated true

SSL: self signed certificate

ID: networking/ssl-self-signed

Also available as: JSON · Markdown
92%Fix Rate
90%Confidence
68Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3 active — — —

Root Cause

The server presents a self-signed certificate that is not trusted by any recognized Certificate Authority. The client rejects the connection because the certificate chain cannot be validated against its trust store.

generic

Workarounds

  1. 95% success Replace the self-signed certificate with a certificate from a trusted CA 
    1. Generate a CSR: openssl req -new -newkey rsa:4096 -nodes -keyout server.key -out server.csr
2. Submit to a CA like Let's Encrypt: certbot certonly --standalone -d yourdomain.com
3. Install the signed certificate on your server
4. Verify the full chain: openssl verify -CAfile ca-bundle.crt server.crt
  2. 90% success Add the self-signed certificate to the client's trust store 
    1. Export the self-signed cert: openssl s_client -connect host:443 </dev/null 2>/dev/null | openssl x509 > server.crt
2. Copy to trust store: cp server.crt /usr/local/share/ca-certificates/
3. Update CA certificates: update-ca-certificates
4. For application-specific trust: set SSL_CERT_FILE or use --cacert flag with curl
5. Verify: curl https://host:443 should succeed without -k flag

Dead Ends

Common approaches that don't work:

  1. Set NODE_TLS_REJECT_UNAUTHORIZED=0 or equivalent to disable verification globally 85% fail

    This disables all TLS certificate verification for the entire process, making it vulnerable to MITM attacks. It is a common but dangerous workaround that security audits will flag, and it masks legitimate certificate problems.

  2. Use HTTP instead of HTTPS to avoid certificate validation entirely 90% fail

    Downgrading to HTTP removes all encryption and authentication, exposing all traffic to interception. Many modern APIs and services reject HTTP connections entirely, and HSTS policies will block the downgrade in browsers.

Error Chain

Leads to:
Preceded by:
Frequently confused with: