TLS handshakes fail intermittently when traffic reaches one origin member. This guide narrows the failure to the responsible component rather than applying broad resets. Start with one controlled observation, follow with the smallest reversible correction, and only then use deeper inspection if the error remains.
Recognize this failure and establish a baseline
Connect to each origin individually from a trusted test environment with its expected SNI. Record the observed result with its time and environment. If you have multiple sites, service accounts, installations or regions, label them clearly so a working control is not confused with the failing target.
DNS, the CDN edge, TLS termination and the origin are distinct hops. A response that looks correct from one network or cache tier can conceal a rule mismatch or a stale edge copy elsewhere. A precise comparison is usually more informative than clearing caches, restarting every service or changing unrelated permissions. Confirm the reproduction using a harmless sample and preserve the current configuration before editing it.
Three ways to isolate the cause
| Diagnostic angle | What to inspect | Interpret the result |
|---|---|---|
| Reproduction and scope | Connect to each origin individually from a trusted test environment with its expected SNI. | If the control succeeds, the difference between the two paths is evidence; do not change their shared infrastructure first. |
| Configuration or contract | A certificate, TLS version or cipher configuration differs between origin nodes. | If the setting, identifier or interface differs from its documented contract, fix that discrepancy in the narrowest possible scope. |
| Runtime and downstream dependencies | Compare origin logs, load balancer health checks, SNI and port 443 configurations. | If the initial configuration is consistent, use timestamps, error codes and component logs to identify the first failing hop. |
First safe fix: change one variable
Recommended correction: Repair the affected node's valid certificate chain and compatible TLS settings. Apply it first in a staging environment or on one limited test object when production traffic, orders or private information could be affected. Write down the previous setting and expected result so a rollback is straightforward.
Why not reset everything? A certificate, TLS version or cipher configuration differs between origin nodes. A broad reset can hide the original cause and create additional failures in permissions, orders, certificates or background jobs. If the proposed correction does not change the exact reproduction test, revert it and move to the advanced inspection instead of stacking speculative fixes.
Step-by-Step Troubleshooting
Choose Beginner for reversible checks or Advanced for scoped investigation with sanitized evidence.
Record the failure boundary
TLS handshakes fail intermittently when traffic reaches one origin member. Capture the precise timestamp, version and one anonymized request, screen or operation. The first objective is to distinguish a consistently failing action from an intermittent side effect; write down what still works.
Perform the smallest comparison
Connect to each origin individually from a trusted test environment with its expected SNI. Keep the account, configuration and data set constant wherever possible. If the comparison requires a staging environment, avoid reproducing it with real payment, customer or production credentials.
Make one reversible correction
Repair the affected node's valid certificate chain and compatible TLS settings. Save or export the setting that will change, note its previous value and alter only this one likely cause. After the adjustment, do not proceed until you have run the same failing operation again.
Prove the outcome
Repeated TLS connections succeed to every origin independently. Repeat the test a second time, including after a safe restart or fresh request when relevant. Verify that a formerly working neighboring feature has not regressed.
Locate the technical ownership
A certificate, TLS version or cipher configuration differs between origin nodes. Identify which component owns this state and whether it is an application setting, remote contract, data store, runtime or security policy. Correlate a single request identifier across layers.
Inspect the deeper signal
Compare origin logs, load balancer health checks, SNI and port 443 configurations. Save only sanitized event identifiers, configuration names and measurements; mask credentials, tokens, private keys, customer information and raw personal content.
Separate competing explanations
Connect to each origin individually from a trusted test environment with its expected SNI. Compare the failing path to a control path. If both fail, investigate their shared dependency; if only one fails, focus on their first differing layer. Reassess a certificate, TLS version or cipher configuration differs between origin nodes.
Validate safely and plan rollback
Repeated TLS connections succeed to every origin independently. Restore the previous setting if the exact failure persists. Document the observed result, the change identifier, and a small repeatable verification for the next release.
Advanced diagnosis: inspect the first failing boundary
Compare origin logs, load balancer health checks, SNI and port 443 configurations. When reading logs, match the same request or transaction across components. A message produced downstream can be secondary to an earlier denial, timeout, incompatible contract or unavailable resource. Use a small known-good request to remove unrelated data from the comparison.
Evidence to keep: Capture the software or protocol version, a masked timestamp, the operation being attempted, the relevant configuration key, and the outcome of the control test. Note both positive and negative findings. If a security rule is involved, preserve the original protection and grant only a narrowly scoped supported exception.
Optional read-only diagnostic
If you have authorized access to the affected host and understand its environment, the following example only inspects state. Replace the example host, service, schema or namespace with your own; it does not repair anything by itself.
openssl s_client -connect origin.example.com:443 -servername www.example.com -showcertsHow to verify the repair
Passing result: Repeated TLS connections succeed to every origin independently. Verify the exact operation rather than assuming that an adjacent screen, health endpoint or cached response proves success. Repeat once under normal conditions and check one previously healthy workflow for regressions.
If the result changes only in staging, compare release version, permissions, environment variables and network path with production. If success is intermittent, compare two successive runs and retain the corresponding log evidence before declaring the incident closed.
Solution Checklist
Safety and rollback
Avoid: Do not reduce TLS verification or adopt Flexible SSL for an invalid origin. Store backups, before-and-after settings and sanitized evidence securely. If the action involves orders, identities, databases or customer information, complete an authorized rollback or request maintenance approval before making another production change.
If it still fails
Return to the first comparison: Connect to each origin individually from a trusted test environment with its expected SNI. Then investigate the remaining owner: Compare origin logs, load balancer health checks, SNI and port 443 configurations. Escalate with a concise timeline and the exact point at which expected behavior differs. Do not send passwords, API keys, recovery codes, complete customer records or private signing material to outside support.
Prevent the next occurrence
Version DNS and edge rules, test both authenticated and anonymous paths, and periodically verify TLS and cache behavior from more than one region. Record the minimum regression test for this exact workflow: Repeated TLS connections succeed to every origin independently. This is more reliable than applying generic maintenance advice each time a dependency changes.