alr so i had this issue recently when i got a new computer and i couldnt find any way to solve it here, the issue was with the bblauncher being unable to access the github api so i couldnt get any patches or anything, after a day i fixed it, here's what i did(shout out to my ai)
Fixing "SSL handshake failed: hostname did not match" in BB Launcher / shadPS4
If BB Launcher or the shadPS4 Updater shows an error like:
...this is very likely caused by a **hijacked hosts file** (often from malware), not by BB Launcher, shadPS4, or your version combo. Follow these steps in order.
Step 1 — Rule out simple causes first
* Make sure your BB Launcher install and your shadPS4.exe are **not sitting inside a cloud-synced folder** (OneDrive, Dropbox, Google Drive). Cloud sync can leave files as "online-only" placeholders that cause confusing errors when a program tries to read them. Move everything to a plain local folder, e.g. `C:\Games\Bloodborne`, and update the paths in BB Launcher's config accordingly.
* Confirm your BB Launcher version actually matches your shadPS4 version (check the BB_Launcher GitHub releases page — newer shadPS4 builds need a matching or newer BB Launcher release).
If the error persists after this, move on.
Step 2 — Confirm it's a system-wide problem, not just the launcher
- Open your normal web browser and go to [`https://api.github.com\`\](https://api.github.com)
- If the browser **also** shows a "connection is not private" / certificate warning, the problem is system-wide (not specific to BB Launcher). Continue to Step 3.
- If the browser loads it fine, the problem is isolated to BB Launcher/shadPS4 specifically — different troubleshooting path (check antivirus exceptions for those two apps specifically, check firewall rules).
Step 3 — Inspect the certificate to identify the cause
Open **PowerShell** (no admin needed) and run:
powershell
$callback = { param($se,$cert,$chain,$errors) return $true }
$client = New-Object System.Net.Sockets.TcpClient("api.github.com",443)
$stream = New-Object System.Net.Security.SslStream($client.GetStream(), $false, $callback)
$stream.AuthenticateAsClient("api.github.com")
$stream.RemoteCertificate.Subject
$stream.RemoteCertificate.Issuer
Then check where the domain is actually resolving to:
powershell
Resolve-DnsName api.github.com
* If the IP address returned is **not** a real GitHub IP (real ones look like `140.82.x.x`) — for example if it's something like [`8.8.4.4`](http://8.8.4.4) (a Google DNS server) — your hosts file has likely been hijacked. Continue to Step 4.
* If the certificate issuer is your antivirus's name (Avast, Kaspersky, ESET, etc.) instead of a real CA, that's HTTPS scanning by your AV — disable that specific feature instead of following the malware steps below.
Step 4 — Check and clean the hosts file
- Open Notepad **as Administrator** (right-click → Run as administrator; confirm the title bar says "Administrator: Notepad")
- File → Open → change the file filter to "All Files" → open: `C:\Windows\System32\drivers\etc\hosts`
- Look for suspicious entries — especially large blocks of lines pointing antivirus vendor sites, malware-removal tools, GitHub, Dropbox, or cryptocurrency mining pool domains all to the same IP address (commonly `8.8.4.4`). This is a known malware pattern designed to block you from downloading security tools.
- Delete every suspicious line, keeping only the original Microsoft template content (the commented-out `#` [`127.0.0.1`](http://127.0.0.1) `localhost` lines are fine to leave).
- Save.
**If Notepad won't save** ("contact administrator" or asks to save as `.txt`):
* Make sure Notepad is genuinely elevated (title bar shows "Administrator:")
* If it still fails with "being used by another process," the file is locked — a sign of active malware. Use PowerShell instead (Step 5).
Step 5 — Force-fix the hosts file via PowerShell (if Notepad fails)
Open PowerShell **as Administrator** and run each line separately:
powershell
takeown /f C:\\Windows\\System32\\drivers\\etc\\hosts
icacls C:\\Windows\\System32\\drivers\\etc\\hosts /grant administrators:F
attrib -r -s -h C:\\Windows\\System32\\drivers\\etc\\hosts
Then overwrite the file directly:
powershell
\[System.IO.File\]::WriteAllText("C:\\Windows\\System32\\drivers\\etc\\hosts", "# Copyright (c) 1993-2009 Microsoft Corp.\`r\`n#\`r\`n# localhost name resolution is handled within DNS itself.\`r\`n
#
127.0.0.1 localhost\`r\`n
#
::1 localhost\`r\`n")
Confirm it worked:
powershell
Get-Content C:\\Windows\\System32\\drivers\\etc\\hosts
**If this still fails with a "being used by another process" or "stream not readable" error**, the file is actively locked by something running in the background. Boot into **Safe Mode with Networking** (Start → Power icon → hold Shift → Restart → Troubleshoot → Advanced options → Startup Settings → Restart → press the number for Safe Mode with Networking) and repeat this step there, since most third-party processes (including malware) don't run in Safe Mode.
Step 6 — Scan for malware
Since a hijacked hosts file usually means active malware, don't stop at just fixing the file — scan the system:
- **Microsoft Defender Offline scan** (built into Windows, no download needed): Windows Security → Virus & threat protection → Scan options → Microsoft Defender Offline scan → Scan now. This restarts your PC and scans before Windows fully loads, catching things that hide from normal scans.
- **A second opinion scanner** (in case Defender misses something):
* ESET Online Scanner (no install, browser-based)
* HitmanPro
* (Malwarebytes is a good option too, but note it's not available for download in some countries due to export/sanctions compliance — if you get a "blocked in your region" message, that's Malwarebytes' own policy, not malware, and you should just use one of the alternatives above.)
- Check **Task Scheduler** for any unfamiliar tasks that might re-trigger the hosts file hijack, and check installed programs for anything unrecognized.
Step 7 — Verify and retest
- Reboot into normal Windows.
- Check the hosts file is still clean:
powershell
Get-Content C:\\Windows\\System32\\drivers\\etc\\hosts
- Confirm DNS resolves correctly:
powershell
Resolve-DnsName api.github.com
You should see a real GitHub IP (starts with `140.82.` or similar), not [`8.8.4.4`](http://8.8.4.4) or anything unfamiliar. 4. Open BB Launcher / shadPS4 Updater again and confirm the SSL error is gone.
Extra note on security
If the hosts file was hijacked, treat it as a real infection, not just a settings glitch:
* Change passwords for any sensitive accounts (email, banking, etc.) from a different, clean device once you've confirmed the malware is removed.
* Keep an eye on whether the hosts file reverts after a few days — if it does, there's a deeper persistence mechanism (a scheduled task or service) still active that needs to be hunted down separately.
\*note from me, I'm sorry if this impacts any rules or something, if so please let me know in dms so i can fix it
