How to fix Unable to connect to the server: net/http: TLS handshake timeout in Kubernetes

KubernetesINTERMEDIATEHIGHUpdated Jul 24, 2026· 373 views

Your kubectl cannot establish a TLS connection to the API server within the timeout period. This indicates network latency, slow server, or SSL/TLS certificate issues.

Quick fix

Fixes Unable to connect to the server: net/http: TLS handshake timeout

kubectl --request-timeout=60s get nodes
  1. Increase the kubectl timeout
  2. Check API server response time
  3. Verify TLS certificates are valid
  4. Check network connectivity
kubernetes — error
kubectl --request-timeout=60s get nodes
Unable to connect to the server: net/http: TLS handshake timeout

What this error means

TLS handshake timeout occurs when kubectl initiates a connection to the API server but cannot complete the SSL/TLS negotiation within the default timeout (usually 15-30 seconds). This can indicate a slow API server, high network latency, or issues with TLS certificates.

Typical symptoms

  • kubectl hangs for 15-30 seconds then fails
  • TLS handshake timeout error in stderr
  • Some kubectl commands succeed while others timeout
  • Intermittent failures depending on network conditions
  • Slow response from API server queries
  • Network packet loss visible with mtr or traceroute

Common causes

  1. API server is overloaded and responding slowly
  2. High latency between client and API server
  3. Network packet loss or congestion
  4. TLS certificate issues or certificate chain problems
  5. Incorrect or expired client certificate
  6. Firewall or network appliance adding delay

How to fix "Unable to connect to the server: net/http: TLS handshake timeout"

1Increase the kubectl timeout

Add a timeout flag to your commands:

bash
kubectl --request-timeout=60s get nodes

Or set it globally in kubeconfig:

bash
kubectl config set-cluster kubernetes --server=https://10.0.0.1:6443 --certificate-authority=ca.crt
2Check API server response time

Monitor API server latency:

bash
time kubectl version

If taking > 5 seconds, the server is slow. Check API server logs on control plane.

3Verify TLS certificates are valid

Check client and server certificates:

bash
openssl x509 -in ~/.kube/cert.crt -text -noout | grep -A2 "Validity"
openssl x509 -in /etc/kubernetes/pki/ca.crt -text -noout | grep -A2 "Validity"

Ensure none are expired.

4Check network connectivity

Use mtr to monitor latency to API server:

bash
mtr -c 10 YOUR_API_SERVER_IP

Look for high latency or packet loss. If present, contact your network admin.

5Scale down or restart API server

If the API server is overloaded:

bash
# Check API server CPU/memory
kubectl top nodes

# If overloaded, restart on control plane:
sudo systemctl restart kubelet

Advanced notes

For managed Kubernetes, contact your cloud provider if control plane is slow. Use kubectl logs for API server diagnostics: kubectl logs -n kube-system kube-apiserver-control-plane. Consider using a local kubeconfig cache proxy. Monitor etcd performance as slow etcd directly impacts API server latency. For high-latency environments (WAN links), increase timeouts further and consider using context-local API proxies.

Frequently asked questions

What does "Unable to connect to the server: net/http: TLS handshake timeout" mean?
TLS handshake timeout occurs when kubectl initiates a connection to the API server but cannot complete the SSL/TLS negotiation within the default timeout (usually 15-30 seconds). This can indicate a slow API server, high network latency, or issues with TLS certificates.
How do I fix "Unable to connect to the server: net/http: TLS handshake timeout"?
Your kubectl cannot establish a TLS connection to the API server within the timeout period. This indicates network latency, slow server, or SSL/TLS certificate issues.
What causes "Unable to connect to the server: net/http: TLS handshake timeout"?
API server is overloaded and responding slowly High latency between client and API server Network packet loss or congestion
Is the "Unable to connect to the server: net/http: TLS handshake timeout" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading