6.3.2. SSL/TLS, Service, and Firewall Troubleshooting

Certificate and protocol failures are a distinct category of security troubleshooting. They often surface as connection errors that look like network problems but are actually trust or configuration issues at the TLS layer.

Certificate validation failures:

• ERR_CERT_AUTHORITY_INVALID — the signing CA is not trusted by the client. For internal CAs, the CA certificate must be distributed to clients via the OS trust store (update-ca-trust on RHEL/CentOS, update-ca-certificates on Debian/Ubuntu).
• Certificate CN/SAN mismatch — the certificate was issued for a different hostname than what was requested. Check: openssl s_client -connect server:443 </dev/null | openssl x509 -noout -subject -ext subjectAltName
• Expired certificate — check: openssl s_client -connect server:443 </dev/null 2>/dev/null | openssl x509 -noout -dates

⚠️ Exam Trap: openssl s_client holds the connection open and waits on stdin, so without </dev/null these pipelines simply hang and look like a network problem. Redirecting stdin from /dev/null makes it print the handshake and exit.

Protocol and cipher problems:

• Deprecated protocols (SSLv3, TLS 1.0, TLS 1.1) may be rejected by modern clients
• Weak cipher suites cause connection failures with hardened clients
• To probe one protocol version at a time, use openssl s_client -connect server:443 -tls1_1 </dev/null — a handshake failure means that version is refused. sslscan and nmap ssl-enum-ciphers (below) list every version and cipher the server accepts; curl -v shows only the single version actually negotiated.
• sslscan server:443 or nmap --script ssl-enum-ciphers -p 443 server enumerate what the server offers
• Handshake CPU cost: a full TLS handshake is dominated by asymmetric crypto, and mutual TLS adds verifying the client's certificate chain on every new connection. If throughput falls and CPU climbs after enabling TLS/mTLS, cut the number of full handshakes with session resumption (session tickets/IDs) and HTTP keep-alive rather than weakening the protocol

Library and binary issues:

• undefined symbol errors after updates indicate shared library version mismatches — the library was found but lacks a function the binary expects, typically because the binary was built against a newer version than the one installed. A library that is missing entirely fails differently: error while loading shared libraries: ... cannot open shared object file
• ldd /path/to/binary shows which shared libraries a binary requires
• ldconfig -p | grep libname shows what's available in the dynamic linker cache

# TLS/Certificate troubleshooting
openssl s_client -connect server:443      # Full TLS handshake + cert chain
openssl s_client -connect server:443 2>&1 | grep -E "Verify|subject|issuer"
openssl x509 -in cert.crt -text -noout   # Inspect certificate details
openssl x509 -in cert.crt -noout -dates  # Just expiry dates
curl -k https://server                    # Skip cert verification (test content)
curl -v https://server 2>&1 | grep -i "ssl\|cert\|verify"

# Common TLS errors and causes
# "certificate verify failed" → cert not trusted (self-signed or wrong CA)
# "certificate has expired" → renew cert
# "hostname mismatch" → cert CN/SAN doesn't match hostname
# "handshake failure" → TLS version or cipher mismatch

# Service-specific troubleshooting
# Apache/Nginx — test config syntax
nginx -t                         # Test nginx config
apachectl configtest             # Test Apache config
apachectl -S                     # Show VirtualHost layout

# Database connectivity
mysql -h db.server -u user -p    # Test MySQL connection
psql -h db.server -U user -d dbname  # Test PostgreSQL connection

# Port-based service check
ss -tulnp | grep :80             # Is something listening on port 80?
ss -tulnp | grep :443            # Port 443?
lsof -i :443                     # What process is using port 443?