Certificate health

This article is for anyone who wants to check whether an SSL/TLS certificate is installed correctly and free of security problems, without needing deep technical knowledge.

Overview

• InfraNest automatically grades every certificate it sees, so you can catch problems before they cause an outage.
• Each certificate has several tabs of information: Chain, Security, and Classification.
• InfraNest can also alert you automatically when something changes or goes wrong.

Check if a certificate is installed correctly

1. Open the certificate you want to check. This works for certificates found on a live endpoint, either through Scan or through a monitor.
2. Select the Chain tab.
3. Look for the plain-language verdict:
   • Installed correctly — everything is set up properly.
   • Missing intermediate — only the Leaf certificate is being served. This can look fine in a browser but break apps, command-line tools, and some phones.
   • Untrusted root or Not trusted by browsers (self-signed) — the Certificate chain doesn't lead back to a trusted Root.

NoteA certificate can appear to work in a browser and still be missing part of its chain. If in doubt, check the Chain tab rather than just visiting the site.

Review the security checks

1. Open the certificate.
2. Select the Security tab to see its Security rating {letter} and a breakdown such as {passed} of {total} passed.
3. Review any flagged issues. These are grouped by seriousness:
   • Critical issue: a Weak key or an outdated method flagged as Uses an outdated signature method (older methods like SHA-1 or MD5).
   • Warnings: Not trusted by browsers (self-signed), a mismatch under Hostname coverage, a certificate that's Valid for longer than allowed, or a Chain (missing intermediate) issue.
4. Select Show the security checks to see the full list of checks and their Status.
5. If there's a fix available, select How to fix this for guidance — for example, you may need to Download the issuing intermediate.

Review classification and set up alerts

1. Open the certificate.
2. Select the Classification tab.
3. Review what InfraNest has detected:
   • What the certificate protects (What this protects), such as Website (TLS), Client auth, Code signing, S/MIME, or Timestamping.
   • Its validation level, such as Domain-validated (DV), Organization-validated (OV), or Extended (EV).
   • Whether it's a Wildcard.
   • Whether it's an Auto-renewing certificate or shows Nothing will renew this certificate.
4. If something looks wrong, select Edit details to correct it, then select Save changes.
5. Check your notification settings under Alerts so you're notified when a certificate is Approaching expiry, changes (Renewed (new certificate), Rotation detected), is flagged as having a Weak key, or shows an Unexpected issuance.

Tips

TipIf a certificate shows Missing intermediate, fixing it usually just means installing the intermediate certificate alongside your leaf certificate on the server — look for Download the issuing intermediate and follow How to fix this.

Troubleshooting

• A certificate shows as healthy in the browser but InfraNest flags an issue. Browsers are often more forgiving than other tools. Trust the Chain and Security tabs — they reflect issues that can break non-browser clients like apps or curl.
• The classification looks wrong. Use Edit details on the Classification tab to set the Correct classification yourself.
• You're not being alerted about an expiring certificate. Confirm the certificate is Monitored rather than just Discovered, not monitored, and check your Alerts settings.