Certificate errors after changing networks: how to debug them without turning off HTTPS
"certificate has expired", "unable to get local issuer certificate", "hostname mismatch" - these are not timeouts, and the fix is never verify=False. Read the full error and go layer by layer: Check the clock. A system time that is off by days makes every valid certificate look expired or not-yet-valid. Sync time first. Check the name. Run openssl sclient -connect example.com:443 -servername example.com and compare the certificate's subject/SAN with the host you typed. A mismatch usually means you are talking to the wrong server or a captive portal. Check the chain. If the leaf is fine but the issuer is unknown, the trust store is old (update ca-certificates or certifi) or something in the middle is re-signing traffic. Compare networks. Try the same command on another connection. If the issuer changes, a middlebox is intercepting; only trust its CA if it is your own organisation's. Tool-specific stores matter: Node, Java and Python may each use their own CA bundle, not the system one. Step-by-step checks with example output: https://roxi.cc/tlserror26.html Written by the small team behind Roxi.