Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
I get a certificate error; how do I diagnose it?
Short answer
The diagnosis starts with getting the exact error code given by the browser or the curl -v output; the code places the error in one of the classes expired, name mismatch, untrusted chain, or TLS version or cipher mismatch. Then, with openssl s_client -servername, which certificate TR7 actually presents is seen and compared with the Certificate field in the vService form; if the SNI does not match any certificate, the first certificate in the list is presented. The validity period and the chain of the certificate are checked on the SSL/TLS Certificates screen. If a protocol error is received, no certificate may be selected in the vService; if the error occurs only while connecting to the Backend Service, the SSL Service settings of the Backend Service are examined.
Problem: The Browser Gives a Certificate Warning
Users see a certificate warning in the browser, or the connection is cut at the TLS stage. It must be determined whether the error comes from the validity period, a name mismatch, a missing chain or the TLS settings, and the right setting must be corrected. TR7 presents the certificate selected in the vService as it is: an expired certificate or one with a missing chain is also presented and causes a browser warning.
Where Is It Monitored?
| Screen | Path | What it shows |
|---|---|---|
| SSL/TLS Certificates list | Certificates & PKI → SSL/TLS Certificates | The Valid until column and the Expiry Health filter (Valid, Expiring Soon, Expired, No Certificate) |
| Chain tab | Certificate preview | The missing link in the chain |
| ACME.sh tab | Certificate preview (ACME.SH type) | The last renewal record |
| Used in tab | Certificate preview | The vServices in which the certificate is selected |
Solution: Three Methods
The methods are applied in order: first the error is classified, then the certificate presented by TR7 is compared with the selection in the vService, and last, the certificate record is examined.
| Your situation | Suitable method |
|---|---|
| Classifying the error | Method 1: Error code |
| Seeing the certificate presented by TR7 | Method 2: openssl and the vService Certificate field |
| Examining the certificate record | Method 3: SSL/TLS Certificates |
Method 1: Error Code Recommended
- How it works The error code given by the browser or by curl determines the class of the error.
- Where it is opened Client
- Requirement No additional setting is required.
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Get the code
The code on the advanced error screen of the browser, or the curl -v https://www.example.com/ output from the client, is obtained.
2
Adım 2 Classify
All the possible causes: The browser says "certificate not trusted"; what are the possible causes?
Verification
1CodeClient side
After the fix, curl -v https://www.example.com/ is run again from the client.
Expected
SSL certificate verify ok.Method 2: openssl and the vService Certificate Field
- How it works openssl shows the certificate TR7 presents for that domain name; when it is compared with the Certificate field of the vService, a missing certificate or a wrong order comes to light. The Certificate field is valid for all the encrypted frontends of the vService.
- Where it is opened Client · vService form → Certificate
- Requirement A client with openssl installed.
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 See the presented certificate
The presented certificate is read from the client by sending the domain name as the SNI:
bash
openssl s_client -connect 192.0.2.10:443 -servername www.example.com </dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltNameA test made without -servername brings the first certificate in the list; if the vService uses Virtual Hosting, the connection is closed.
2
Adım 2 Open the vService edit form
On the Load Balancer → Load Balancer vService List screen, the vService is selected and the Edit button is clicked. If Virtual Hosting is used, the vService that serves the domain name is opened (Can I serve different certificates for different domains on the same IP:443 (SNI)?).
3
Adım 3 Check the Certificate field
In the Certificate field, it is checked that the certificate covering the domain name is selected and that the certificate to be presented to clients that do not send SNI is first in the list. The field appears while at least one encrypted frontend is defined in the vService.
4
Adım 4 Save
If a change was made, the Save button is clicked.
Verification
1CertificateClient side
The openssl command is run again.
Expected
subjectAltName contains the domain name; notAfter is a future dateMethod 3: SSL/TLS Certificates
- How it works The certificate record shows the validity dates, the chain and the ACME renewal history.
- Where it is openedCertificates & PKI → SSL/TLS Certificates
- Requirement No additional setting is required.
- vService type HTTP
Step-by-Step Configuration
1
Adım 1 Separate the expired ones
On the Certificates & PKI → SSL/TLS Certificates screen, the expired (Expired) certificates and those with less than 30 days left (Expiring Soon) are separated with the Expiry Health filter (How do I filter certificates that have expired or are about to expire (Expiry Health)?).
2
Adım 2 Examine the record
The certificate is selected; in the preview, the dates are read in the Details tab, the missing link in the chain in the Chain tab, and, if it was obtained with ACME, the last renewal record in the ACME.sh tab (How do I tell if the certificate chain is incomplete?).
3
Adım 3 Separate the Backend Service side
If the error appears not in the browser but as a 502 or 503, the problem is in the TLS connection that TR7 establishes to the Backend Service: the SSL Service, Certificate Verification and SNI settings of the Backend Service and the Certificate error text in the Health Checks tab in the preview are examined (Can I verify the backend certificate when connecting to the backend over HTTPS?).
Verification
1RecordTR7 side
The Valid until column and the Details and Chain tabs are checked.
Expected
Valid; the chain is complete up to the root certificateCommon Mistakes
- Testing without
-servername. When SNI is not sent, the first certificate in the list comes; with Virtual Hosting, on the other hand, the connection is closed. - Confusing a trust error with a protocol error. A TLS version mismatch and an encrypted frontend with no certificate selected are separate classes.
- Adding the new certificate as a separate record and forgetting to change it in the vService. If the existing record is updated, the selection in the vServices is preserved (When I renew a certificate, do I need to replace it on each vService one by one?).
- Looking at the wrong vService with Virtual Hosting. The Certificate field of the vService that serves the domain name is checked.
- Asking for support without collecting information if the problem persists. What to add to the support ticket: Which information should I collect before contacting TR7 support?
How it is done in the documentation
