Certificate errors after changing networks: how to debug them without turning off HTTPS

"certificate has expired", "unable to get local issuer certificate", "hostname mismatch" - these are not timeouts, and the fix is never verify=False. Read the full error and go layer by layer:

1. Check the clock. A system time that is off by days makes every valid certificate look expired or not-yet-valid. Sync time first.
2. Check the name. Run openssl s_client -connect example.com:443 -servername example.com and compare the certificate's subject/SAN with the host you typed. A mismatch usually means you are talking to the wrong server or a captive portal.
3. Check the chain. If the leaf is fine but the issuer is unknown, the trust store is old (update ca-certificates or certifi) or something in the middle is re-signing traffic.
4. Compare networks. Try the same command on another connection. If the issuer changes, a middlebox is intercepting; only trust its CA if it is your own organisation's.
5. Tool-specific stores matter: Node, Java and Python may each use their own CA bundle, not the system one.

Step-by-step checks with example output: https://roxi.cc/tlserror26.html

Written by the small team behind Roxi.