Playbook

TLS Handshake Failures

Triage certificate, chain, SNI, and cipher mismatch issues quickly.

Check certificate validity dates and renewal status.

Confirm the correct cert is deployed on all edge nodes.

Validate key and cert match (public key hash).

Ensure full chain (intermediate + root) is served.

Validate SNI mapping for multi-tenant or wildcard certs.

Verify hostname matches SAN entries.

Compare client-supported cipher list vs server config.

Ensure TLS 1.2/1.3 support matches client requirements.

Disable legacy suites only after confirming client compatibility.

Inspect certificate chain

openssl s_client -connect example.com:443 -servername example.com -showcerts

Check expiration date

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

List supported ciphers

nmap --script ssl-enum-ciphers -p 443 example.com