# Certificate health > InfraNest checks every certificate it knows about and tells you, in plain words, whether anything is wrong with it — so you find out before your visitors do. Source: https://infranest.io/docs/certificate-health Last updated: 2026-09-19 --- This article is for anyone who wants to know whether a certificate is safe to use, or why InfraNest is flagging one — no technical background needed. ## Overview - InfraNest checks every certificate it knows about and tells you, in plain words, whether anything is wrong with it — so you find out before your visitors do. - Open any certificate and the answer is the first thing you see on the page. - Checks cover things like renewal, trust, key strength, hostname coverage, and more. ## See what's wrong with a certificate 1. Go to **Certificates**. 2. Select the certificate you want to look at. 3. **Security posture** sits at the top of the page, with a score in the corner — *7/8* means seven checks passed and one didn't. It opens showing only what needs your attention — on a certificate with nothing wrong, a green **No security issues**. Select **Show … passed** at the bottom to see every check, and select any row to read what it means and what to do about it. ![Certificate health](/media/3fe2ee84-d859-42b6-b588-53e3a08ca926) There are no tabs to go through — everything else described here is further down the same page. ## What each check means **Renewal** is the one that causes outages. It says either that the certificate renews itself (and through what), or that **Nothing will renew this certificate** — in which case it names the day the site starts serving an expired certificate. **Monitor** appears for certificates a browser has to trust. It tells you whether a live SSL monitor is watching this one, and offers to add it. Without a monitor, a break is only found by the next scan instead of the moment it happens. Then the checks on the certificate itself: - **Key** and **Signature** — is the certificate's encryption strong enough, and was it signed with a method still considered safe? These two are marked as a **Critical issue** if they fail: the certificate is weak, not just untidy. - **Trust** — is this a certificate browsers accept, or a self-signed one? - **Hostname coverage** — is the address you're monitoring actually listed on the certificate? If it isn't, browsers will warn about it. - **Validity period** — a certificate valid for longer than the 398 days now allowed. Browsers reject those. - **Chain** — how the certificate was served. See below. - **CAA** — you can publish a rule in **DNS CAA records** saying which companies are allowed to issue certificates for your domain. If this certificate's issuer isn't on that list, it's either a mistake to fix or a certificate somebody got that you didn't expect. Chain and CAA only appear when InfraNest has something to say: a chain is recorded only where a live check or a scan actually saw the certificate being served, and CAA only where the domain publishes a policy to check against. ## Is it installed correctly? For certificates seen on a live address, the **Certificate chain** section further down the page shows what the server sent and grades it: - **Installed correctly** — the full chain up to a root browsers trust. Nothing to do. - **Missing intermediate** — only the certificate itself was sent. This often works in browsers but breaks apps and some phones, which is what makes it easy to miss. - **Untrusted root** or **Not trusted by browsers (self-signed)** — the chain doesn't lead back to anything browsers trust. When an intermediate is missing, a **How to fix this** panel explains what to add to your server, with a **Download the issuing intermediate** link where the issuer publishes one. ![Certificate health](/media/8210c1f0-ce23-498a-b478-01bd890e4a5b) ## Correct what InfraNest worked out InfraNest fills in a certificate's details from the certificate itself, and it can be wrong — a bought certificate that renews through your host looks the same as one nobody renews. To correct it, use **Certificate actions → Edit details** at the top of the page: - **Validation** — whether the issuer checked just the domain (**Domain-validated (DV)**), the company behind it (**Organization-validated (OV)**), or ran an extended check (**Extended (EV)**). - **Owner** — who in your team looks after this certificate. - **Auto-renewing certificate** — tick this if something renews it for you. Expiry alerts for it then stay informational instead of urgent. - Notes — anything worth remembering about it. Everything else — **Covered domains**, issuer, **Valid from**, **Serial**, and its **Certificate ID (SHA-256)** — is read from the certificate and can't be edited, because changing it here wouldn't change the certificate. > [!NOTE] > A certificate InfraNest only ever saw in a **Public log (crt.sh)**, or in a provider's list, has no chain or monitoring information, because nobody watched it being served. That's why some sections aren't on every certificate. ## When InfraNest tells you You don't have to come and look. InfraNest alerts you when a certificate is **Approaching expiry** or has expired, when the certificate served on an address changes (**Rotation detected**), when one **Failed a security check**, when it's **Revoked**, and when there's an **Unexpected issuance** for your domain. Your team already gets these in-app and by email; to send them somewhere else, and to choose which of them that destination receives, go to **Alerts → Destinations**. > [!TIP] > The **Hygiene** figure in the strip at the top of the page is the same checks counted up, with a **Security rating {letter}** beside it. It's withheld once a certificate has expired — there's nothing to grade. ## Good to know - The **Hygiene** score and **{passed} of {total} passed** count reflect the exact same checks shown when you select **Show the security checks**. - Sections like **Certificate chain** and CAA simply won't appear on certificates InfraNest never saw served live.