Post History

How do I diagnose TLS errors?

For reasons of my own, I have services on my LAN which use HTTPS and I create my own certificates for these.

Over the years, the usage of TLS has evolved considerably. Many features that were once supported are no longer considered secure, and there are many things that were once "optional" but now are required by most software.

Browsers are maddeningly unhelpful here. When something is wrong with the certificate, I get a very opaque "You're getting hacked!" style message. If I am lucky I can sometimes dig up an error code buried somewhere. But it's very hard to take this error code and figure out what exactly I'm doing wrong when generating the cert. A search for a browser TLS error code is inevitably cluttered with user advice about things like asking your sysadmin or checking if your modem is unplugged. 🙄

Is there a way that I can check my server's certificate and figure out exactly what does not conform to current best practice? This would have to be a client side program. I've seen some websites where you plug in a hostname and they check the TLS for you, but my server is on LAN only and won't be accessible for those, and in any case they won't have my CA installed.