Certificate health

This article is for anyone who wants to know whether a certificate is safe to use, or why InfraNest is flagging one — no technical background needed.

Overview

• InfraNest checks every certificate it knows about and tells you, in plain words, whether anything is wrong with it — so you find out before your visitors do.
• Open any certificate and the answer is the first thing you see on the page.
• Checks cover things like renewal, trust, key strength, hostname coverage, and more.

See what's wrong with a certificate

1. Go to Certificates.
2. Select the certificate you want to look at.
3. Security posture sits at the top of the page, with a score in the corner — 7/8 means seven checks passed and one didn't.

It opens showing only what needs your attention — on a certificate with nothing wrong, a green No security issues. Select Show … passed at the bottom to see every check, and select any row to read what it means and what to do about it.

There are no tabs to go through — everything else described here is further down the same page.

What each check means

Renewal is the one that causes outages. It says either that the certificate renews itself (and through what), or that Nothing will renew this certificate — in which case it names the day the site starts serving an expired certificate.

Monitor appears for certificates a browser has to trust. It tells you whether a live SSL monitor is watching this one, and offers to add it. Without a monitor, a break is only found by the next scan instead of the moment it happens.

Then the checks on the certificate itself:

• Key and Signature — is the certificate's encryption strong enough, and was it signed with a method still considered safe? These two are marked as a Critical issue if they fail: the certificate is weak, not just untidy.
• Trust — is this a certificate browsers accept, or a self-signed one?
• Hostname coverage — is the address you're monitoring actually listed on the certificate? If it isn't, browsers will warn about it.
• Validity period — a certificate valid for longer than the 398 days now allowed. Browsers reject those.
• Chain — how the certificate was served. See below.
• CAA — you can publish a rule in DNS CAA records saying which companies are allowed to issue certificates for your domain. If this certificate's issuer isn't on that list, it's either a mistake to fix or a certificate somebody got that you didn't expect.

Chain and CAA only appear when InfraNest has something to say: a chain is recorded only where a live check or a scan actually saw the certificate being served, and CAA only where the domain publishes a policy to check against.

Is it installed correctly?

For certificates seen on a live address, the Certificate chain section further down the page shows what the server sent and grades it:

• Installed correctly — the full chain up to a root browsers trust. Nothing to do.
• Missing intermediate — only the certificate itself was sent. This often works in browsers but breaks apps and some phones, which is what makes it easy to miss.
• Untrusted root or Not trusted by browsers (self-signed) — the chain doesn't lead back to anything browsers trust.

When an intermediate is missing, a How to fix this panel explains what to add to your server, with a Download the issuing intermediate link where the issuer publishes one.

Correct what InfraNest worked out

InfraNest fills in a certificate's details from the certificate itself, and it can be wrong — a bought certificate that renews through your host looks the same as one nobody renews. To correct it, use Certificate actions → Edit details at the top of the page:

• Validation — whether the issuer checked just the domain (Domain-validated (DV)), the company behind it (Organization-validated (OV)), or ran an extended check (Extended (EV)).
• Owner — who in your team looks after this certificate.
• Auto-renewing certificate — tick this if something renews it for you. Expiry alerts for it then stay informational instead of urgent.
• Notes — anything worth remembering about it.

Everything else — Covered domains, issuer, Valid from, Serial, and its Certificate ID (SHA-256) — is read from the certificate and can't be edited, because changing it here wouldn't change the certificate.

NoteA certificate InfraNest only ever saw in a Public log (crt.sh), or in a provider's list, has no chain or monitoring information, because nobody watched it being served. That's why some sections aren't on every certificate.

When InfraNest tells you

You don't have to come and look. InfraNest alerts you when a certificate is Approaching expiry or has expired, when the certificate served on an address changes (Rotation detected), when one Failed a security check, when it's Revoked, and when there's an Unexpected issuance for your domain. Your team already gets these in-app and by email; to send them somewhere else, and to choose which of them that destination receives, go to Alerts → Destinations.

TipThe Hygiene figure in the strip at the top of the page is the same checks counted up, with a Security rating {letter} beside it. It's withheld once a certificate has expired — there's nothing to grade.

Good to know

• The Hygiene score and {passed} of {total} passed count reflect the exact same checks shown when you select Show the security checks.
• Sections like Certificate chain and CAA simply won't appear on certificates InfraNest never saw served live.