{"record":{"id":"070fbfcfec03f540","repo":"louislam/uptime-kuma","slug":"certificate-is-invalid","errorCode":null,"errorMessage":"Certificate is invalid","messagePattern":"Certificate is invalid","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/monitor-types/tcp.js","lineNumber":269,"sourceCode":"                        const info = checkCertificate(socket);\n                        resolve(info);\n                    } catch (error) {\n                        reject(error);\n                    }\n                });\n\n                socket.on(\"error\", (error) => {\n                    reject(error);\n                });\n\n                socket.setTimeout(1000 * TIMEOUT, () => {\n                    reject(new Error(\"Connection timed out\"));\n                });\n            });\n\n            await monitor.handleTlsInfo(tlsInfoObject);\n            if (!tlsInfoObject.valid) {\n                throw new Error(\"Certificate is invalid\");\n            }\n        } catch (error) {\n            const message = error instanceof Error ? error.message : \"Unknown error\";\n            throw new Error(`TLS Connection failed: ${message}`);\n        } finally {\n            if (socket && !socket.destroyed) {\n                socket.end();\n            }\n        }\n    }\n\n    /**\n     * Check for expected TLS alert (for mTLS verification)\n     * @param {object} monitor Monitor object\n     * @param {object} heartbeat Heartbeat object\n     * @param {string} expectedTlsAlert Expected TLS alert name\n     * @returns {Promise<void>}\n     */","sourceCodeStart":251,"sourceCodeEnd":287,"githubUrl":"https://github.com/louislam/uptime-kuma/blob/6b5ea0155793e666666745fb8d6fef1e829543a2/server/monitor-types/tcp.js#L251-L287","documentation":"Thrown by checkTlsCertificate() after a TLS handshake completed and checkCertificate() returned a tlsInfoObject whose 'valid' field is false. This indicates the certificate itself failed Uptime-Kuma's validity rules (expired, not-yet-valid, untrusted CA, hostname mismatch, revoked). The error is then re-wrapped by the surrounding catch into 'TLS Connection failed: Certificate is invalid'.","triggerScenarios":"Produced when monitor.smtpSecurity is 'secure' or 'starttls', expiry notification is enabled, the TLS handshake succeeds, but checkCertificate() flags the cert invalid — e.g. notAfter in the past, self-signed/untrusted chain, CN/SAN mismatch with monitor.hostname, or a broken chain.","commonSituations":"Expired certificate; self-signed cert without a trusted root; intermediate chain not served by the server; certificate issued for a different hostname; clock skew on the Uptime-Kuma host making a valid cert appear expired/not-yet-valid; recently renewed cert not yet deployed.","solutions":["Inspect the full tlsInfoObject (cert info, daysRemaining, issuer) via Uptime-Kuma's cert transparency view to see the exact failure reason.","Renew and redeploy the certificate if it is expired or near expiry.","Serve the full intermediate chain so the path to a trusted root can be built.","Correct clock skew on the Uptime-Kuma host (NTP).","If the cert is legitimately self-signed for internal use, install the CA into the host trust store or disable expiry/cert notification for that monitor."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"function isCertValid(tlsInfo) { return !!tlsInfo && tlsInfo.valid === true; }","typeGuard":"function isCertValid(tlsInfo) { return !!tlsInfo && tlsInfo.valid === true && (tlsInfo.daysRemaining == null || tlsInfo.daysRemaining > 0); }","tryCatchPattern":"if (!isCertValid(tlsInfoObject)) { heartbeat.status = DOWN; heartbeat.msg = `Certificate is invalid (${tlsInfoObject.certInfo_messages?.join(\", \")})`; return; }","preventionTips":["Monitor certificate expiry separately so renewals happen before failure.","Serve the full intermediate chain so the path to a trusted root builds.","Keep the Uptime-Kuma host clock synced via NTP.","For internal CAs, add the root to the host trust store."],"tags":["tls","ssl","certificate","security","tcp"],"backgroundTag":null,"analyzedSha":"6b5ea0155793e666666745fb8d6fef1e829543a2","analyzedAt":"2026-08-12T23:42:12.959Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}