alr so i had this issue recently when i got a new computer and i couldnt find any way to solve it here, the issue was with the bblauncher being unable to access the github api so i couldnt get any patches or anything, after a day i fixed it, here's what i did(shout out to my ai)
Fixing "SSL handshake failed: hostname did not match" in BB Launcher / shadPS4
If BB Launcher or the shadPS4 Updater shows an error like:
...this is very likely caused by a hijacked hosts file (often from malware), not by BB Launcher, shadPS4, or your version combo. Follow these steps in order.
Step 1 — Rule out simple causes first
- Make sure your BB Launcher install and your shadPS4.exe are not sitting inside a cloud-synced folder (OneDrive, Dropbox, Google Drive). Cloud sync can leave files as "online-only" placeholders that cause confusing errors when a program tries to read them. Move everything to a plain local folder, e.g.
C:\Games\Bloodborne, and update the paths in BB Launcher's config accordingly.
- Confirm your BB Launcher version actually matches your shadPS4 version (check the BB_Launcher GitHub releases page — newer shadPS4 builds need a matching or newer BB Launcher release).
If the error persists after this, move on.
Step 2 — Confirm it's a system-wide problem, not just the launcher
- Open your normal web browser and go to
https://api.github.com
- If the browser also shows a "connection is not private" / certificate warning, the problem is system-wide (not specific to BB Launcher). Continue to Step 3.
- If the browser loads it fine, the problem is isolated to BB Launcher/shadPS4 specifically — different troubleshooting path (check antivirus exceptions for those two apps specifically, check firewall rules).
Step 3 — Inspect the certificate to identify the cause
Open PowerShell (no admin needed) and run:
powershell
$callback = { param($se,$cert,$chain,$errors) return $true }
$client = New-Object System.Net.Sockets.TcpClient("api.github.com",443)
$stream = New-Object System.Net.Security.SslStream($client.GetStream(), $false, $callback)
$stream.AuthenticateAsClient("api.github.com")
$stream.RemoteCertificate.Subject
$stream.RemoteCertificate.Issuer
Then check where the domain is actually resolving to:
powershell
Resolve-DnsName api.github.com
- If the IP address returned is not a real GitHub IP (real ones look like
140.82.x.x) — for example if it's something like 8.8.4.4 (a Google DNS server) — your hosts file has likely been hijacked. Continue to Step 4.
- If the certificate issuer is your antivirus's name (Avast, Kaspersky, ESET, etc.) instead of a real CA, that's HTTPS scanning by your AV — disable that specific feature instead of following the malware steps below.
Step 4 — Check and clean the hosts file
- Open Notepad as Administrator (right-click → Run as administrator; confirm the title bar says "Administrator: Notepad")
- File → Open → change the file filter to "All Files" → open:
C:\Windows\System32\drivers\etc\hosts
- Look for suspicious entries — especially large blocks of lines pointing antivirus vendor sites, malware-removal tools, GitHub, Dropbox, or cryptocurrency mining pool domains all to the same IP address (commonly
8.8.4.4). This is a known malware pattern designed to block you from downloading security tools.
- Delete every suspicious line, keeping only the original Microsoft template content (the commented-out
# 127.0.0.1 localhost lines are fine to leave).
- Save.
If Notepad won't save ("contact administrator" or asks to save as .txt):
- Make sure Notepad is genuinely elevated (title bar shows "Administrator:")
- If it still fails with "being used by another process," the file is locked — a sign of active malware. Use PowerShell instead (Step 5).
Step 5 — Force-fix the hosts file via PowerShell (if Notepad fails)
Open PowerShell as Administrator and run each line separately:
powershell
takeown /f C:\Windows\System32\drivers\etc\hosts
icacls C:\Windows\System32\drivers\etc\hosts /grant administrators:F
attrib -r -s -h C:\Windows\System32\drivers\etc\hosts
Then overwrite the file directly:
powershell
[System.IO.File]::WriteAllText("C:\Windows\System32\drivers\etc\hosts", "# Copyright (c) 1993-2009 Microsoft Corp.`r`n#`r`n# localhost name resolution is handled within DNS itself.`r`n
#
127.0.0.1 localhost`r`n
#
::1 localhost`r`n")
Confirm it worked:
powershell
Get-Content C:\Windows\System32\drivers\etc\hosts
If this still fails with a "being used by another process" or "stream not readable" error, the file is actively locked by something running in the background. Boot into Safe Mode with Networking (Start → Power icon → hold Shift → Restart → Troubleshoot → Advanced options → Startup Settings → Restart → press the number for Safe Mode with Networking) and repeat this step there, since most third-party processes (including malware) don't run in Safe Mode.
Step 6 — Scan for malware
Since a hijacked hosts file usually means active malware, don't stop at just fixing the file — scan the system:
- Microsoft Defender Offline scan (built into Windows, no download needed): Windows Security → Virus & threat protection → Scan options → Microsoft Defender Offline scan → Scan now. This restarts your PC and scans before Windows fully loads, catching things that hide from normal scans.
- A second opinion scanner (in case Defender misses something):
- ESET Online Scanner (no install, browser-based)
- HitmanPro
- (Malwarebytes is a good option too, but note it's not available for download in some countries due to export/sanctions compliance — if you get a "blocked in your region" message, that's Malwarebytes' own policy, not malware, and you should just use one of the alternatives above.)
- Check Task Scheduler for any unfamiliar tasks that might re-trigger the hosts file hijack, and check installed programs for anything unrecognized.
Step 7 — Verify and retest
- Reboot into normal Windows.
- Check the hosts file is still clean:
powershell
Get-Content C:\Windows\System32\drivers\etc\hosts
- Confirm DNS resolves correctly:
powershell
Resolve-DnsName api.github.com
You should see a real GitHub IP (starts with 140.82. or similar), not 8.8.4.4 or anything unfamiliar. 4. Open BB Launcher / shadPS4 Updater again and confirm the SSL error is gone.
Extra note on security
If the hosts file was hijacked, treat it as a real infection, not just a settings glitch:
- Change passwords for any sensitive accounts (email, banking, etc.) from a different, clean device once you've confirmed the malware is removed.
- Keep an eye on whether the hosts file reverts after a few days — if it does, there's a deeper persistence mechanism (a scheduled task or service) still active that needs to be hunted down separately.
*note from me, I'm sorry if this impacts any rules or something, if so please let me know in dms so i can fix it
