Intermittent cURL error 60: SSL: no alternative certificate subject name matches target host name 'api.openai.com' — daily but not on every request

API Bugs
,
1

We’re seeing intermittent TLS failures when calling the OpenAI API from a PHP/Laravel backend. The error happens most days, but only for a fraction of requests — most calls succeed normally, then a burst of failures occurs, then it clears up on its own.

Exact error:

cURL error 60: SSL: no alternative certificate subject name matches target host name 'api.openai.com' (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for https://api.openai.com/v1/chat/completions

Also seen on https://api.openai.com/v1/images/generations, so it doesn’t look tied to one specific endpoint.

Environment:

  • PHP 8.2+ (Laravel app)
  • openai-php/laravel v0.18.0 (openai-php/client v0.18.0), which uses Guzzle/cURL under the hood
  • Shared PHP hosting (no root/vhost access, so we can’t inspect the host’s outbound DNS resolver or any transparent proxy directly)
  • cURL with OpenSSL backend, HTTP/2 enabled

What we already tried:

  • Wrapped all chat/image calls in a retry (3 attempts, exponential backoff 1s/2s/4s) that specifically catches cURL error / SSL / timeout messages. It helps but the failure sometimes survives all 3 attempts, which suggests whatever bad state causes this (stale/wrong DNS resolution, or a wrong certificate being served) lasts at least several seconds — not a single-packet blip.
  • Ruled out an expired/misconfigured cert on our side — this is a server-presented certificate not matching api.openai.com, on outbound requests to OpenAI, not an inbound cert on our own domain.

Questions for the community:

  1. Has anyone else seen this specific error against api.openai.com, and if so, did you trace it to DNS (stale/incorrect A record resolution) vs. a CDN/edge node presenting the wrong SNI cert?
  2. Is there a recommended way to pin or verify OpenAI’s expected certificate/IP ranges from the client side, to make the retry smarter (e.g. detect-and-skip a bad resolution) rather than just blindly retrying?
  3. Any known incidents on OpenAI’s edge (Cloudflare-fronted infra) involving intermittent cert mismatches that would explain a “clears up after some seconds/minutes” pattern?

Any pointers appreciated — happy to share more logs/timestamps if useful for triage.

2

Hi @Cr0w ! Thanks for sharing all the details and what you've already tried!

Since the SSL certificate mismatch is happening intermittently across multiple API endpoints, it’s a bit tricky to narrow down what might be causing it.

Just wanted to check if you're still running into this issue. If so, could you share a few recent timestamps (including timezone) when the errors occurred, along with the request IDs, if available?

Also, since you're on shared hosting with limited access to network settings, have you had a chance to contact your hosting provider to check for any intermittent outbound DNS resolution, proxy routing, or TLS interception issues when connecting to api.openai.com?

-Basil