OL-1224 — TLS certificate not trusted

What happened

The TLS handshake to the destination failed certificate verification. The most common cause on an enterprise network is a TLS-inspecting proxy or firewall re-signing outbound traffic with an interception CA that is not in the OS trust store and was not supplied via ca_bundle — from the client's point of view that looks identical to a real machine-in-the-middle, which is exactly why it refuses the handshake instead of guessing. The fix is almost always to point ca_bundle at the interception root, never to disable verification.

What to do

Point OPENLATCH_CA_BUNDLE (or ca_bundle in the [proxy] section) at your network's root certificate, then run openlatch system proxy test. Never turn verification off.

Note

This page is generated from the client source at a pinned commit. The message above is what the client prints.