tls-handshake-debugging

Diagnose a failing TLS connection: "SSL handshake failed", "tlsv1 alert", "unable to get local issuer certificate", "works in the browser but not curl", "certificate required" on mTLS. Establish TCP reachability, then run openssl s_client -connect host:443 -servername host -showcerts, because a missing SNI returns the wrong certificate. Read in order: certificate served, whether the chain includes the intermediate (browsers fetch it via AIA, curl and Java do not), hostname against SAN not CN, validity dates and client clock, protocol and cipher overlap, ALPN, and for mTLS the CertificateRequest and CA list. Separate server faults from client trust with --resolve from a clean client; capture the alert first. Use for any handshake failure. Not for an internal CA that clients do not trust yet (private-ca-trust-distribution), issuance and renewal (certificate-automation), allowed protocols (host-hardening) or app code (debugging).