06 Systems support · TLS · OpenSSL

TLS certificate and hostname triage

A loopback service test separates an untrusted issuer from a hostname mismatch, then verifies the corrected certificate and HTTPS response.

Issue: The service port answers, but the client refuses HTTPS. Is the issuer untrusted, or does the certificate identify a different hostname?
Decisive evidence: The trusted wrong-host certificate failed hostname verification, while the expected certificate failed when its issuer was not trusted.E01
Result: A reachable port is not enough. The client must trust the issuer and the requested hostname must match the certificate.
Boundary: This is a short-lived loopback lab.Full limit

Completion: Complete within stated scope
Execution: Local OpenSSL service run
Review: Scripted assertions and artifact check
Evidence: Selected evidence on this page

macOS ARM64
OpenSSL 3.6
curl
Loopback only

The support question

The service port answers, but the client refuses HTTPS. Is the issuer untrusted, or does the certificate identify a different hostname?

Project record: The local certificate authority and service certificates, two failure states, handshake inspection, certificate correction, and repeated HTTPS check.

Interactive view

A TLS connection has more than one gate.

Port reachability stays available in both failures. The selected state shows which certificate check stops the request.

Choose a viewWrong hostnameUntrusted issuerVerified retest

TCP answers and the issuer is trusted, but the requested hostname is absent from the certificate.

01
TCP portService answers
02
HostnameSAN match
03
Issuer trustCA available
04
HTTPSApplication response

TLS checks

Separate port reachability, hostname validation, and issuer trust.

01
Create a private lab authority and issue separate certificates for the expected and incorrect hostnames.
02
Serve the incorrect certificate while trusting the lab authority and record the hostname verification failure.
03
Serve the expected certificate without the authority file and record the trust failure.
04
Use the expected certificate and authority together, inspect the handshake, and run a separate HTTPS retest.

Evidence from the lab

The checks used to reach the conclusion.

Selected outputs from the lab. Sensitive and unnecessary details are omitted.

curl: (60) SSL: no alternative certificate subject name matches target host name 'service.lab.test'

E01 · Captured lab outputHostname mismatchThe issuer was trusted, but the certificate did not contain the requested service hostname.

View artifact Back to C01

curl: (60) SSL certificate problem: unable to get local issuer certificate

E02 · Captured lab outputUntrusted issuerThe expected hostname was served, but the client did not have the private lab authority.

View artifact Back to C01

subject=CN=service.lab.test
issuer=CN=Portfolio Lab CA
Protocol: TLSv1.3
Verify return code: 0 (ok)

E03 · Captured lab outputCertificate inspectionOpenSSL reports the expected subject, the lab issuer, TLS 1.3, and a successful verification return code.

View artifact Back to C02

Full evidence archive2 additional artifacts

http_code=200
remote_ip=127.0.0.1
ssl_verify_result=0

E04 · Captured lab outputSeparate HTTPS retestA new request after correction records the HTTP status, loopback address, and certificate result.

View artifact Back to C02

Public package
• hostname failure
• issuer-trust failure
• certificate check
• separate HTTPS retest
• SHA-256 checksums

E05 · Captured lab outputEvidence checksumsThe public package lists the failure outputs, certificate check, retest, and environment record.

View artifact Back to C01

Result and limits

What changed, and what this lab does not prove.

Result

The hostname test and issuer-trust test both failed with curl exit 60 for different reasons. The corrected service returned HTTP 200 with certificate verification result 0.

Limit

This is a short-lived loopback lab. It does not test public certificate issuance, browser policy, OCSP, load balancers, or production renewal.

Claims and evidence

What the evidence supports.

The trusted wrong-host certificate failed hostname verification, while the expected certificate failed when its issuer was not trusted.

The two states use a private lab authority and one local service.

EvidenceE01 E02

With the expected hostname and trusted issuer, the retest returned HTTP 200 and certificate verification result 0.

The successful result covers one loopback HTTPS endpoint.

EvidenceE03 E04