Debugging handshake failures

1. 1

   Reproduce from the client's position

   Same hostname, same network path, same client software. A laptop on the corporate network with a proxy is a different client.

2. 2

   Read the exact error

   'Unable to get local issuer certificate' is not the same as 'unknown authority'. Each points somewhere different.

3. 3

   Inspect the presented chain

   Confirm the leaf, the intermediates and their order.

4. 4

   Check names and dates

   SAN coverage and validity windows.

5. 5

   Check trust store

   Is the root present in this runtime's store, and is the system clock sane?

6. 6

   Only then change configuration

   Change one variable at a time and re-test.

# 1. What does the server send?
echo | openssl s_client -connect host:443 -servername host -showcerts 2>/dev/null

# 2. What does the leaf say?
openssl s_client -connect host:443 -servername host </dev/null 2>/dev/null | openssl x509 -noout -text

# 3. What protocol and suite were negotiated?
openssl s_client -connect host:443 -servername host </dev/null 2>/dev/null | grep -E "Protocol|Cipher"

# 4. Does a specific trust store accept the chain?
openssl s_client -connect host:443 -servername host -CAfile ca-bundle.pem -verify_return_error </dev/null

For deeper work, Wireshark shows the handshake as a sequence of records, which makes downgrade and negotiation problems visible. For client-side issues in Java or Python, remember they carry their own trust stores.

A Python service fails with 'certificate verify failed', while curl on the same host succeeds. curl uses the system store and follows AIA to fetch a missing intermediate; the Python client uses its own bundle and does not. The fix is not to relax verification in Python, but to correct the chain the server sends.