Certificate Findings

A finding is a problem or a weakness the certificate check found on a monitor: an expired certificate, a hostname it doesn't cover, a missing CAA record. Each finding has a key (such as CERT_HST02), a title (Certificate doesn't cover this hostname), a short label used in alerts and on the report's Checks card (Name Does Not Match), and a severity. The pages in this section explain each one and how to fix it; the How to Fix It link on a finding in the portal opens its entry here.

How the Check Works

On every check we look up the monitor's hostname, connect to each address it resolves to, complete the TLS handshake (after STARTTLS, for the protocols that use it), and read the certificate chain the server sends. Then we check each certificate and the domain's DNS:

Check	What it looks at	Findings
Connection	Reaching the service and completing the handshake	CERT_NET01 - CERT_NET09
Expiration	The certificate's validity dates	CERT_EXP01 - CERT_EXP03
Validity period	How long the certificate is valid for	CERT_LIF01
Hostname	Whether the certificate covers the hostname	CERT_HST01 - CERT_HST02
Chain of trust	Whether the chain leads to a trusted root or your private CA	CERT_TRU01 - CERT_TRU03
Revocation	Whether the CA has revoked the certificate	CERT_REV01
Signature algorithm	How the certificate is signed	CERT_SIG01 - CERT_SIG03
Key strength	The certificate's key algorithm and size	CERT_KEY01 - CERT_KEY02
CAA	The domain's CAA records in DNS	CERT_CAA01 - CERT_CAA07
Consistency	Whether every address serves the same certificate	CERT_CON01 - CERT_CON02

Severities

Findings use one severity scale, from least to most serious:

Severity	Meaning
Notice	A suggestion: nothing is broken, but something could be better. The report counts notices as suggestions.
Warning	Something that needs attention soon, or will break later.
Error	Something that is broken now, or that clients will reject.
Critical	The most serious problems. No certificate finding is critical today.

A monitor's status on the report and the monitor list comes from its worst finding. Which findings send an alert is set on the monitor's profile.

When the Connection Fails

A check goes through its stages in order: the DNS lookup, the address, the connection, the TLS handshake, and reading the certificate. Each stage needs the one before it to have worked, so on each address only the earliest failure is a finding. A connection that times out, for example, shows Connection to the service timed out, and not also a finding for the certificate that couldn't be read after it. Certificate couldn't be read (CERT_NET01) appears on its own only when nothing more specific explains it.

The checks that need a certificate then say Not checked on the report's Checks card, with the addresses they couldn't run on. The CAA check only needs the DNS lookup, so it still runs.

Dismissing a Finding

Notices, and No CAA record (CERT_CAA01), can be dismissed on a monitor where you've decided not to act on them: click the × beside the finding on the report's Findings card, or select monitors on the finding's details on the Findings page and click Dismiss.

A dismissed finding stops counting toward the monitor's status and counts, doesn't alert, and is left out of the Findings page and the shared and exported reports. It still shows on the Checks card as information, marked (dismissed), with Restore beside the check's name to bring it back. Dismissing applies to that one monitor only.

Every Finding

Key	Title	Label	Severity	Can be dismissed
CERT_NET01	Certificate couldn't be read	Certificate Not Read	Error	No
CERT_NET02	Check couldn't connect (internal error)	Network Failure	Error	No
CERT_NET03	Connection to the service failed	Network Failure	Error	No
CERT_NET04	Connection to the service timed out	Network Timeout	Error	No
CERT_NET05	STARTTLS upgrade failed	STARTTLS Failure	Error	No
CERT_NET06	TLS handshake failed	SSL Failure	Error	No
CERT_NET07	Hostname doesn't resolve in DNS	DNS Failure	Error	No
CERT_NET08	Hostname resolves to a private address	Private IP Blocked	Error	No
CERT_NET09	Mail server rejected the connection	Connection Rejected	Error	No
CERT_EXP01	Certificate expires soon	Expires Soon	Warning	No
CERT_EXP02	Certificate has expired	Expired	Error	No
CERT_EXP03	Certificate validity dates are invalid	Invalid Expiration Dates	Error	No
CERT_LIF01	Certificate valid for more than 90 days	Long Reg Period	Notice	Yes
CERT_HST01	Hostname only in the Common Name	Matched CN, No SAN	Notice	Yes
CERT_HST02	Certificate doesn't cover this hostname	Name Does Not Match	Error	No
CERT_TRU01	Chain not trusted by the monitor's private CA	Not Trusted	Error	No
CERT_TRU02	Chain not trusted by public CAs	Not Trusted	Error	No
CERT_TRU03	Root certificate sent in the chain	Root Sent	Notice	Yes
CERT_REV01	Certificate revoked by its CA	Revoked	Error	No
CERT_SIG01	Signature algorithm not recognized	Unknown Sig Algorithm	Warning	No
CERT_SIG02	Weak signature algorithm	Weak Sig Algorithm	Error	No
CERT_SIG03	Insecure signature algorithm	Insecure Sig Algorithm	Error	No
CERT_KEY01	Certificate key too short	Weak Key Algorithm	Error	No
CERT_KEY02	Legacy key algorithm	Legacy Key Algorithm	Error	No
CERT_CAA01	No CAA record	CAA Not Found	Warning	Yes
CERT_CAA02	CAA record only on a parent domain	CAA Not Specific	Notice	Yes
CERT_CAA03	CAA record doesn't allow this CA	CAA Record Failure	Error	No
CERT_CAA04	CAA record has an unknown critical tag	CAA Critical Tag	Warning	No
CERT_CAA05	CAA lookup failed	CAA Lookup Failed	Warning	No
CERT_CAA06	CAA record forbids every CA	CAA Forbids All Issuers	Error	No
CERT_CAA07	CAA record is malformed	CAA Record Malformed	Error	No
CERT_CON01	Addresses serve different certificates	Certs Did Not Match	Error	No
CERT_CON02	Certificate keeps changing between checks	Certificate Flapping	Warning	No