{"record":{"id":"ab6ce0a115e45cd1","repo":"louislam/uptime-kuma","slug":"tls-certificate-is-not-authorized-tlsinfo-error","errorCode":null,"errorMessage":"TLS certificate is not authorized: ${tlsInfo.error}","messagePattern":"TLS certificate is not authorized: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/monitor-types/globalping.js","lineNumber":454,"sourceCode":"        );\n        heartbeat.status = UP;\n    }\n\n    /**\n     * Updates the TLS information for a monitor.\n     * @param {object} monitor - The monitor object.\n     * @param {string} protocol - The protocol used for the monitor.\n     * @param {object} probe - The probe object containing location information.\n     * @param {object} tlsInfo - The TLS information object.\n     * @returns {Promise<void>}\n     */\n    async handleTLSInfo(monitor, protocol, probe, tlsInfo) {\n        if (!tlsInfo) {\n            return;\n        }\n\n        if (!monitor.ignoreTls && protocol === \"HTTPS\" && !tlsInfo.authorized) {\n            throw new Error(this.formatResponse(probe, `TLS certificate is not authorized: ${tlsInfo.error}`));\n        }\n\n        let tlsInfoBean = await R.findOne(\"monitor_tls_info\", \"monitor_id = ?\", [monitor.id]);\n\n        if (tlsInfoBean == null) {\n            tlsInfoBean = R.dispense(\"monitor_tls_info\");\n            tlsInfoBean.monitor_id = monitor.id;\n        } else {\n            try {\n                let oldCertInfo = JSON.parse(tlsInfoBean.info_json);\n\n                if (\n                    oldCertInfo &&\n                    oldCertInfo.certInfo &&\n                    oldCertInfo.certInfo.fingerprint256 !== tlsInfo.fingerprint256\n                ) {\n                    log.debug(\"monitor\", \"Resetting sent_history\");\n                    await R.exec(","sourceCodeStart":436,"sourceCodeEnd":472,"githubUrl":"https://github.com/louislam/uptime-kuma/blob/6b5ea0155793e666666745fb8d6fef1e829543a2/server/monitor-types/globalping.js#L436-L472","documentation":"Thrown by handleTLSInfo for an HTTPS monitor when ignoreTls is false and the probe-reported tlsInfo.authorized is false. The specific TLS error (expired, self-signed, hostname mismatch, untrusted CA) from tlsInfo.error is included. handleTLSInfo is only called when no keyword/jsonQuery short-circuited the HTTP check.","triggerScenarios":"protocol === 'HTTPS', monitor.ignoreTls is false, and result.tls.authorized === false. The certificate failed Node's verification: EXPIRED, self-signed (UNABLE_TO_VERIFY_LEAF_SIGNATURE), hostname mismatch (ERR_CERT_COMMON_NAME_INVALID), or an untrusted chain.","commonSituations":"Certificate expired and not renewed, self-signed certificate used in staging/internal hosts, certificate issued for a different hostname, or an incomplete intermediate chain.","solutions":["Renew/replace the certificate if it is expired or malformed","Fix hostname mismatches by serving the cert for the correct CN/SAN","Install the full intermediate chain on the server","If the self-signed/untrusted cert is intentional, enable 'Ignore TLS/Error' (ignoreTls) on the monitor"],"exampleFix":"// before: self-signed cert breaks HTTPS monitor, ignoreTls off\nmonitor.ignoreTls = false;\n// after: accept the cert you control\nmonitor.ignoreTls = true; // or fix the cert chain","handlingStrategy":"validation","validationCode":"// Nothing to validate at runtime for the remote cert, but you can decide policy:\n// If the cert is intentionally untrusted, set ignoreTls.\nif (monitor.ignoreTls) {\n    log.debug(\"monitor\", \"TLS errors will be ignored for this monitor\");\n}","typeGuard":null,"tryCatchPattern":"if (!monitor.ignoreTls && protocol === \"HTTPS\" && !tlsInfo.authorized) {\n    throw new Error(this.formatResponse(probe, `TLS certificate is not authorized: ${tlsInfo.error}`));\n}","preventionTips":["Monitor certificate expiry so you renew before it lapses","Serve the full certificate chain including intermediates","Enable ignoreTls only for self-signed/internal hosts you control"],"tags":["globalping","tls","certificate","https"],"backgroundTag":null,"analyzedSha":"6b5ea0155793e666666745fb8d6fef1e829543a2","analyzedAt":"2026-08-12T23:42:12.959Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}