Introduction

Select correct key usage bits for RSA key transport vs ECDH key agreement scenarios requires systematic diagnosis across multiple technical layers. This guide provides enterprise-grade troubleshooting procedures with deep technical analysis suitable for complex production environments.

Symptoms and Impact Assessment

### Primary Indicators - TLS/SSL handshake failures reported by clients or load balancers - Certificate validation errors appear in browser or application logs - HTTPS connections fail intermittently or consistently depending on root cause - Related services depending on secure channels may exhibit cascading failures

### Business Impact Analysis - Customer-facing services unavailable over HTTPS causing revenue loss - API integrations broken when certificate trust cannot be established - Compliance violations for PCI-DSS, HIPAA, or SOC2 encryption requirements - Security exposure if fallback to unencrypted connections is permitted

Technical Background

### TLS Protocol Context Understanding TLS handshake mechanics, certificate chain validation, and cipher suite negotiation is essential for effective diagnosis of SSL/TLS failures.

### Certificate Authority Trust Model The PKI trust hierarchy, certificate transparency requirements, and revocation checking mechanisms all affect whether clients will accept presented certificates.

Root Cause Analysis Framework

### Diagnostic Methodology

  1. **Capture TLS handshake** - Use openssl s_client, Wireshark, or SSL Labs to examine certificate presentation
  2. **Validate certificate chain** - Verify complete chain from leaf to trusted root with openssl verify
  3. **Check revocation status** - Test OCSP and CRL accessibility and response validity
  4. **Analyze cipher compatibility** - Compare server offerings with client requirements
  5. **Review configuration drift** - Compare current TLS settings against known-good baseline

### Common Root Cause Categories

| Category | Typical Indicators | Investigation Priority | |----------|-------------------|----------------------| | Certificate expiration | Sudden complete failure, date-correlated | Critical | | Chain incomplete | Browser warnings, mobile client failures | High | | Cipher mismatch | Protocol-level handshake failures | High | | Revocation check timeout | Slow connections, intermittent failures | Medium | | SNI misconfiguration | Wrong certificate served for hostname | Medium | | CT policy violation | Chrome-specific rejections | Low |

Step-by-Step Remediation

### Phase 1: Immediate Triage (0-30 minutes)

  1. **Verify certificate validity** - Check expiration dates and subject names match expected values.
  1. **Test from multiple clients** - Determine if failure is universal or client-specific to narrow root cause.
  1. **Capture current certificate** - Save certificate and chain for analysis before any replacement.
  1. **Enable fallback if available** - Consider temporary CDN or load balancer certificate to restore service.

### Phase 2: Systematic Diagnosis (30-120 minutes)

  1. **Run SSL Labs test** - Use Qualys SSL Labs for comprehensive certificate and configuration analysis.
  1. **Trace certificate chain** - Use openssl s_client -showcerts to capture full chain presentation.
  1. **Check revocation infrastructure** - Verify OCSP responder and CRL distribution point accessibility.
  1. **Validate private key match** - Confirm certificate and private key are cryptographically paired.

### Phase 3: Targeted Resolution (2-8 hours)

  1. **Replace or renew certificate** - Install valid certificate with complete chain and matching private key.
  1. **Update intermediate certificates** - Ensure all required intermediate CA certificates are installed.
  1. **Configure cipher suites** - Enable compatible cipher suites while maintaining security requirements.
  1. **Verify SNI configuration** - Confirm correct certificate selection for each hostname on shared IPs.

### Phase 4: Prevention and Hardening (Post-Incident)

  1. **Implement certificate monitoring** - Deploy automated expiration alerts with 30-day advance warning.
  1. **Automate renewal** - Where possible, implement ACME-based automatic certificate renewal.
  1. **Document certificate inventory** - Maintain current record of all certificates, locations, and renewal dates.
  1. **Test renewal procedures** - Practice certificate replacement in non-production to validate runbooks.

Technical Deep Dive

### Advanced Diagnostics

For complex cases requiring deeper analysis:

  • Decode certificate with openssl x509 -text to examine all extensions
  • Compare certificate fingerprints across environments
  • Analyze TLS session resumption behavior
  • Test with openssl s_client using various protocol versions

### Common Pitfalls

Avoid these counterproductive actions:

  • Replacing certificates without capturing current state for comparison
  • Installing certificates without verifying private key match
  • Disabling security features (like CT validation) as permanent workaround
  • Skipping validation of complete chain including intermediates

Monitoring and Alerting Strategy

| Metric Category | Specific Metrics | Alert Threshold | Data Source | |----------------|------------------|-----------------|-------------| | Certificate validity | Days until expiration | <30 days warning | Certificate scanner | | Chain completeness | Chain validation status | Any validation error | Load balancer | | Cipher strength | Weak cipher usage | Any export/TLS1.0 | SSL Labs | | OCSP health | OCSP response time | >5 seconds | Synthetic monitoring |

  • RFC 5280: Internet X.509 Public Key Infrastructure
  • RFC 8446: TLS Protocol Version 1.3
  • CA/Browser Forum Baseline Requirements
  • Vendor-specific certificate deployment guides

Conclusion

Systematic SSL/TLS troubleshooting following this methodology enables efficient resolution while building organizational capability. The key principles are: capture current state before changes, validate certificate chain completely, test from multiple client perspectives, and implement proactive monitoring to prevent recurrence.