Outbound SSL handshake failed: certificate validation error

The target server is using a self-signed certificate that is not trusted by ServiceNow's certificate store. (high likelihood)

The server's SSL certificate has expired and needs to be renewed by the external system administrator. (high likelihood)

The certificate is issued by a Certificate Authority (CA) that is not included in ServiceNow's default trust store. (medium likelihood)

The server's certificate chain is incomplete, missing intermediate certificates required for proper validation. (medium likelihood)

The certificate's Common Name (CN) or Subject Alternative Name (SAN) does not match the hostname being accessed. (low likelihood)

Step 1: Navigate to System Diagnostics > Log > Application Log and search for the exact error message to identify which outbound connection is failing and the target URL.

Step 2: Test the target URL in a browser or use SSL checker tools to verify the certificate status, expiration date, and issuing authority.

Step 3: If the certificate is valid but from an untrusted CA, download the certificate chain from the target server using your browser or openssl commands.

Step 4: Navigate to System Definition > Certificates in ServiceNow to access the certificate management interface.

Step 5: Click 'New' to create a new certificate record and paste the certificate content in PEM format, ensuring you include the BEGIN and END CERTIFICATE lines.

Step 6: Set the certificate Type to 'Trust Store Certificate' and Format to 'PEM' to add it to ServiceNow's trusted certificate store.

Step 7: Save the certificate record and wait 5-10 minutes for the certificate cache to refresh before testing the connection again.

Step 8: Re-execute the failing integration or script to verify the SSL handshake now completes successfully and check the System Log for confirmation.