OneLinersCommand workbench
Verified diagnostic signature

The peer certificate is outside its validity window or does not identify the requested host.

Match output from tls, understand the likely cause, then continue with sourced, read-only checks.

Confidence
high
Platforms
linux · macos · windows
Verified
2026-07-24
Recognized output

Signature matched locally

no alternative certificate subject name matches

OneLiners matches this pattern in your browser. Your pasted output is not stored or indexed.

Likely causes

What usually produces this signal

  1. Expired renewal
  2. Wrong SNI
  3. Wrong virtual host
  4. Clock skew
Safe next checks

Collect evidence before changing the system

01

Inspect a remote TLS certificate

openssl s_client -connect <host>:<port> -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

The output matches the expected target and exits without an error.

02

Calculate how many days remain on a remote TLS certificate

end=$(openssl s_client -connect <host>:<port> -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2); echo "notAfter=$end"; echo "daysRemaining=$(( ($(date -d "$end" +%s) - $(date +%s)) / 86400 ))"

The output matches the expected target and exits without an error.

03

Show the negotiated TLS protocol, cipher, and peer certificate

openssl s_client -brief -connect <host>:<port> -servername <host> </dev/null 2>&1 | rg 'Protocol|Ciphersuite|Peer certificate|Verification'

The output matches the expected target and exits without an error.