A host has a certificate or TLS configuration problem

Accept TLS 1.2 and 1.3 only

Serve the full certificate chain in nginx

1. Put your certificate and the intermediate certificates of your certificate authority in one file, your own certificate first: cat www.example.com.crt bundle.crt > www.example.com.chained.crt (use your own file names).
2. Point ssl_certificate at that file and reload nginx.

How to check: openssl s_client -connect [host]:443 -servername [host] </dev/null 2>/dev/null | grep "Verify return code" (expect: 0 (ok))

Issue a certificate for the host name

1. Issue a certificate that lists [host], and install it on the server that answers for [host].
2. If the host is no longer used, remove its DNS record.

How to check: openssl s_client -connect [host]:443 -servername [host] </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Serve the full certificate chain

1. Install the intermediate certificates your certificate authority supplies, in the order it gives.

How to check: openssl s_client -connect [host]:443 -servername [host] </dev/null 2>/dev/null | grep "Verify return code" (expect: 0 (ok))

Renew the certificate and automate renewal

1. Renew the certificate for [host] now.
2. Turn on automatic renewal and check that the renewal job can reload the server.

How to check: openssl s_client -connect [host]:443 -servername [host] </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Accept TLS 1.2 and 1.3 only

1. Remove weak cipher suites from the TLS settings of [host], and allow TLS 1.2 and 1.3 only.
2. If a CDN or load balancer ends the TLS connection, the setting is there, not on your server.
3. We do not give a cipher list, because the right one depends on the server and the clients you must support.

How to check: openssl s_client -connect [host]:443 -servername [host] </dev/null 2>/dev/null | grep -i cipher

Find out who ordered the certificate

1. Ask whoever manages hosting, the CDN and marketing tools whether they ordered it.
2. If one of them did, mark the certificate as known.
3. If nobody did, check the DNS records of [host] for a target you no longer control, and ask the issuer to revoke the certificate.

How to check: The certificate is marked as known, or the issuer confirms it is revoked.

An expired TLS certificate stopped Google Voice from connecting new calls for 4 hours and 22 minutes on 15 and 16 February 2021, according to Google's own incident report.

Source: BleepingComputer, 28 February 2021, on Google's incident report