Fastly Origin TLS Errors: Hostname Mismatch, Unable to Verify Certificate

How to fix it

Try these in order — the most common fix is first.

1. 1. Set the certificate hostname

   Copy steps
   1. Clone the service to edit and open Origins
   2. Edit the affected host
   3. Enter the CN or SAN from your certificate in Certificate Hostname
   4. Save and activate on production (custom VCL: .ssl_cert_hostname)
   Did this fix it? Yes No

2. 2. Provide the CA certificate

   Copy steps
   1. Paste the PEM-formatted CA certificate into the TLS CA certificate field (custom VCL: .ssl_ca_cert)
   2. Or use a certificate from a CA in Fastly's bundle
   Did this fix it? Yes No

3. 3. Renew an expired certificate

   1. Submit a new CSR to your CA and install the signed certificate on the origin
   Did this fix it? Yes No

4. 4. Fix protocol errors

   Copy steps
   1. Test the origin with openssl s_client using the matching -tls1_x flag, or sslscan
   2. Update server software and TLS libraries; block RC4
   3. If the origin has no TLS, disable Enable TLS? and use port 80
   Did this fix it? Yes No

Symptoms

503 errors with messages such as Hostname mismatch, unable to verify the first certificate, self signed certificate, Certificate has expired or SSL handshake failure.

Why it happens

• Certificate CN/SAN does not match the origin host or certificate hostname setting
• Self-signed or private CA certificate with no CA provided
• Origin certificate expired
• Origin does not use TLS, or supports only outdated protocols (Fastly supports TLS 1.0 to 1.3, not SSLv2/3)
• Origin offers only the RC4 cipher

This guide also covers

• fastly hostname mismatch
• fastly unable to verify the first certificate
• fastly ssl handshake failure origin
• fastly certificate has expired

The same problem in other apps

All not loading, error messages & connection guides →

• Cloudflare Error 521: Web Server Is Down (Cloudflare)

Other Fastly errors

• Fastly Error: Unknown Domain
• Fastly 503 Backend Read Error / Connection Timeout
• Fastly Purge Not Working (Old Content Still Served)
• Fastly TLS Certificate Stuck Pending or Not Provisioning
• Fastly Not Caching: Always X-Cache MISS
• Fastly Serves Wrong Content or Denies Requests From Origin (Override Host)
• How to Cancel Fastly Account