Skip to content
AI Security

Interview question · Network Security & Protocols

A TLS connection fails. How do you tell an untrusted chain, a hostname mismatch, a pin failure and an interception proxy apart?

Every TLS error is a specific check failing. Engineers who can name which check, from the chain the client actually saw, fix outages in minutes and never 'fix' them by turning validation off.

mediumNewPreparation tags: Google, Amazon, MicrosoftUpdated Nov 2026

Every TLS error is a specific check failing. Engineers who can name which check, from the chain the client actually saw, fix outages in minutes and never 'fix' them by turning validation off.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

Users report 'certificate not trusted' errors on an internal service after a change, while the server team says the certificate is valid.

  1. What do you look at first?
  2. What causes an untrusted issuer error?
  3. What other checks fail commonly?
  4. What if only some clients fail?
  5. What must not be the fix?
  6. How would you diagnose and fix it?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackHow does a corporate TLS inspection proxy work, and what security and privacy risks does it introduce?Next in this trackLeaf certificate, public key, intermediate or root: what should a client pin, and why did HTTP Public Key Pinning fail on the web?Next in this trackHow would you secure remote access: a traditional VPN or zero-trust network access? What attacks target each?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.