Webhook SSL / TLS Certificate error: handshake failures

A TLS/SSL Handshake Error occurs when the webhook provider attempts to establish an encrypted HTTPS connection to your server and aborts because the SSL certificate is invalid, untrusted, or incomplete.

Common causes of webhook SSL failures

• Expired SSL/TLS certificate: If automatic certificate renewal (e.g. Let's Encrypt, Certbot) failed, the provider's HTTP client will refuse to connect.
• Missing Intermediate CA Certificates: While standard desktop web browsers often cache intermediate certificates, automated webhook servers (such as Stripe or GitHub's fleet) enforce strict certificate bundle validation. You must configure full-chain certificates (fullchain.pem).
• Self-signed certificates on public endpoints: Production webhook senders reject self-signed certificates outright.
• Server Name Indication (SNI) & TLS 1.0/1.1: Modern providers require TLS 1.2 or TLS 1.3 with valid SNI configuration on multi-tenant servers.

Local development without SSL headaches

When testing webhooks locally, avoid exposing raw IP addresses or self-signed HTTPS tunnels. HookWatch provides managed TLS on all ingestion endpoints (https://hooks.hookwatch.dev/in/...), forwarding deliveries securely to your local development machine via the HookWatch CLI.