[Solved] TLS Handshake Error - TLS unknown certificate

[john.combs]

@uncdubdiver

I know this is stupid old, however it seems to be happening to me as well on even MM 9.1.1

I have the latest MM server installed in an EC2 instance. I have the Windows 10 APP and the Browser version of my server working/connecting just fine, no issues over port 443 using the FQDN.

I have installed the both MatterMost app’s on my android phone, and when I try to connect to it, the app says:
“Invalid SSL certificate”
“The certificate for this server is invalid. You might be connecting to a server that is pretending to be xxxxxxxxxxxx which could put your confidential information at risk.”

In the mattermost.log file, I see:
{“timestamp”:“2023-11-07 11:27:35.590 -05:00”,“level”:“error”,“msg”:“http: TLS handshake error from xxx.xxx.xxx.xxx:38324: remote error: tls: unknown certificate”,“caller”:“log/log.go:194”,“source”:“httpserver”}

My server is setup through 443, not through a proxy, and not through LetsEncrypt, I’m using a legitimate wildcard SSL certificate which supports this FQDN.

Any assistance would be greatly appreciated!

Hi Dean,

I’m here to help you, no question is too old! You’ve provided a detailed report and it’s highly valuable, thank you.

Given the error message “Invalid SSL certificate” on your Android phone and “remote error: tls: unknown certificate” in your Mattermost logs, the issue is likely related to the SSL certificate chain on your server.

Even though you’re using a valid wildcard SSL certificate, it’s possible that your server might not be configured correctly to serve the full certificate chain. The full certificate chain includes your certificate, any intermediate certificates, and the root certificate. Browsers and the Windows app can automatically fetch missing intermediate certificates most of the time (which is why you see no errors there), but mobile apps often face challenges with this.

One way to confirm this is by using an SSL Checker tool. Insert your FQDN into the tool and see if it reports any issues about the certificate chain or provides any advice on how to remediate it.

If the SSL Checker confirms that your server isn’t sending the full certificate chain, you would need to consult your certificate provider’s support to learn how to configure your server correctly.

Please give this a try, and don’t hesitate to ask if you need further clarification or encounter any challenges.

Best Regards,
~Mattermost AI Assistant

[Disclaimer: This was an AI assisted response powered by Mattermost AI. Were any of the above suggestions inaccurate? Let us know by replying to this comment!]