How to Fix Certificate verify failed Error in SSL/TLS

Quick Answer: The Certificate verify failed error occurs when your application cannot validate the SSL/TLS certificate presented by a server. This can happen due to expired certificates, self-signed certificates without proper configuration, or missing certificate authority files. Update your certificate, add the CA certificate to your trust store, or disable certificate verification only in development environments.

What Causes This Error

SSL certificate expired or not yet valid
Certificate authority not in trust store
Self-signed certificate without proper configuration
Certificate domain name mismatch
Intermediate certificate missing from chain
System clock out of sync affecting validation
Certificate revoked by issuing authority

Step-by-Step Fixes

Fix 1: Update SSL Certificate

Check certificate expiration: openssl x509 -enddate -noout -in cert.pem,If expired, request new certificate from issuing authority,Install new certificate on server,Update certificate path in application configuration,Restart application to use new certificate

Fix 2: Add Certificate Authority to Trust Store

Obtain CA certificate from issuing authority,On Linux: sudo cp ca.pem /usr/local/share/ca-certificates/ && sudo update-ca-certificates,On macOS: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ca.pem,On Windows: certutil -addstore -f "ROOT" ca.pem,Restart application and test connection

Fix 3: Configure Self-Signed Certificate

Generate self-signed certificate: openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365,In application, disable certificate verification (development only): process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0",Or configure to use specific certificate: https.globalAgent = new https.Agent({ ca: fs.readFileSync("cert.pem") }),For production, use proper CA-signed certificate,Test connection with: curl --cacert cert.pem https://localhost

Fix 4: Fix Certificate Chain Issues

Verify certificate chain: openssl s_client -connect host:443 -showcerts,Check for intermediate certificates: openssl x509 -text -noout -in cert.pem | grep -A1 "Authority",Ensure all certificates in chain are installed on server,Concatenate certificates in correct order: cat cert.pem intermediate.pem root.pem > fullchain.pem,Update server configuration to use full chain

Fix 5: Sync System Clock

Check system time: date,If time is incorrect, update it: sudo date -s "2026-03-26 11:00:00",Or use NTP: sudo timedatectl set-ntp true,Verify time is synchronized: timedatectl status,Retry SSL connection after clock is synchronized

Advanced Fixes

Advanced Fix 1: Debug OpenSSL Handshake

Enable verbose OpenSSL logging: export SSLKEYLOGFILE=/tmp/sslkeylog.log (for client-side debugging) or adjust server logging levels.,Run your application or client connection attempt.,Analyze the SSLKEYLOGFILE or server logs for specific handshake failures, protocol mismatches, or cipher suite negotiation issues.,Use `openssl s_client -connect host:port -debug -state -msg` to get detailed output of the SSL/TLS handshake process.,Consult OpenSSL documentation or security forums with the specific debug output for advanced analysis.

Advanced Fix 2: Bypass Certificate Validation (Development Only)

Understand that this is a security risk and should NEVER be used in production environments.,For Python requests: `requests.get('https://example.com', verify=False)`,For Node.js: `process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';` (set before `require('https')`),For Java HttpClient: Use a custom `TrustManager` that trusts all certificates (e.g., `new X509TrustManager() { ... }`).,Only use this for isolated development or testing when the server certificate cannot be immediately fixed.