# A certificate check fails although the certificate is valid > The padlock in your browser looks fine, but InfraNest flags the certificate, or an SSL monitor says it's down. Source: https://infranest.io/docs/certificate-check-fails Last updated: 2026-10-26 --- If your browser shows a valid padlock but InfraNest flags a problem, or an SSL monitor reports your site as down, this article is for you. ## Overview - Browsers are forgiving: they fill in missing certificate pieces and remember what they've seen before on other sites. - Our checks, and the apps, payment providers and other servers that connect to your site, are not forgiving in the same way. - When our results disagree with your browser, we're usually seeing what those other visitors see, not what you see. ## Find which check fails 1. Go to **Certificates** and open the certificate. 2. **Security posture** at the top lists only the checks that need attention. Select a row to read what it means and what to do. ![A certificate check fails although the certificate is valid](/media/acdacfda-6545-4a51-a4cc-63b311d218e9) If it's an SSL monitor that's down, open the monitor under **Monitoring**. Its message is less specific: **Couldn't establish a secure (SSL/TLS) connection**, or **SSL certificate problem** for a website monitor. Either way, open the certificate as above to find out which part failed. ## Fix an incomplete certificate chain If **Chain** says **Missing intermediate**, your server is sending its own certificate but not the one that links it to a certificate authority browsers trust. Browsers often have that piece remembered from another site, so they don't notice — apps, and our checks, do. 1. Select **View chain**. 2. Open the **How to fix this** panel. It links to the missing intermediate where the issuer publishes it. 3. Add the intermediate to your server's certificate file (usually called the bundle or full chain). 4. Restart the web server. Most hosts and control panels have a dedicated field for this. ## Fix a missing address on the certificate If **Hostname** says **The site's address isn't on the certificate**, the certificate you have doesn't list the exact address being checked. For example, a monitor checking `www.example.com` will fail if the certificate only covers `example.com`. 1. Either point the monitor at an address the certificate covers, 2. or get a certificate that includes the address you need. > [!NOTE] > A certificate for `*.example.com` covers `www.example.com` but not `example.com` itself, and not `shop.eu.example.com`. ## Fix a certificate mismatch across servers Your site may serve different certificates to different visitors. This happens when: - the address points at several servers, and one of them still has an old certificate; - the site has an IPv6 address, and the server behind it was never given the new certificate; - a load balancer or CDN sits in front, and its certificate is not the one on your server; - the server hosts several sites and hands out a default certificate for an address it doesn't recognise. When we see a different certificate at an address we watch, you get a **Certificate changed** alert, and the other certificate appears as its own row on the **Certificates** page. Open that row to see which certificate our check received, then install the right one on the server or service that's handing it out. ## Fix a CAA issuer mismatch If **CAA** says **Issuer not authorized by the domain's CAA policy**, your DNS has a rule naming which companies may issue certificates for your domain, and this certificate's issuer isn't on it. The certificate still works, but your next renewal may be refused. 1. Select **Manage CAA**. 2. Either add the issuer to the rule, or check whether you expected this certificate at all. ## Check again after fixing it 1. For a monitor, select **Run now** on the monitor's page. 2. For a certificate without a monitor, go to **Certificates**, select **Add certificate**, choose **Scan an endpoint**, enter the address, and select **Scan**. The existing certificate is updated. > [!TIP] > You don't have to fix things in a hurry — every address is scanned again once a day automatically.