new·Earn with mozg — 20% of every monthSend somebody here and take a fifth of every plan payment they make, for as long as they keep paying — not a bounty on the first invoice. Your handle is the link, the window is thirty days, and the commission lands on your balance the second they pay. Free to join: if you have signed in, you already have the link. mozg.sh/earnall news →
mozg.beta
Sign in

Temporal · all subjects

troubleshooting

8 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Failed reaching server error causes

The message 'Failed reaching server: last connection error' can result from an expired TLS certificate or during Server startup when Client requests reach the Server before roles are fully initialized.

Verify TLS certificate expiration with Temporal CLI

Use the command `temporal cloud namespace mtls cert-ca list --namespace <namespace_id>.<account_id>` to list and read the expiration date of the TLS certificate from the certificate details in the output.

Verify TLS certificate expiration with tcld

Use the command `tcld namespace accepted-client-ca list --namespace <namespace_id>.<account_id> | jq -r '.[0].notAfter'` to extract the certificate expiration date.

Verify TLS certificate with OpenSSL

Run `openssl s_client -connect <namespace_grpc_endpoint> -showcerts -cert ~/certs/path.pem -key .~/certs/path.key -tls1_2` to verify the TLS connection using existing certificate management infrastructure.

Verify TLS certificate with self-signed certificate

Run `temporal namespace describe --namespace <namespace_id>.<account_id> --address <namespace_grpc_endpoint> --tls-cert-path <path-to-mTLS-pem-file> --tls-key-path <path-to-mTLS-key-file>` to verify a self-signed certificate. The Namespace gRPC endpoint is available on the Temporal Cloud Namespace details page.

Certificate renewal process

If a certificate has expired or is about to expire, contact the certificate authority (CA) that issued the certificate and request a renewal. For self-signed certificates or without existing infrastructure, generate a new certificate using OpenSSL, step CLI, or similar tools.

Update CA certificate in Temporal Cloud server configuration

After renewing the TLS certification, update the new CA certificate in the Temporal Cloud server configuration using either the Temporal Cloud UI or tcld, then retry the connection.

Troubleshooting connection errors after certificate update

If the 'failed reaching server' error persists after updating the TLS certificate, verify that the Client is using the correct TLS certification and that Client requests reach the server after roles are fully initialized.

Give your agent this brain