TLS certificate does not validate
The TLS handshake for the scanned origin reported a certificate validation failure.
Why it matters
A certificate validation failure can prevent browsers, API clients, and integrations from connecting safely. The effect and remediation depend on the specific validation reason.
How ShipReady detects it
What it inspects
ShipReady opens a TLS connection to the origin host and lets certificate validation run during the handshake.
What triggers a finding
The rule triggers when the handshake reports a certificate verification error, such as an untrusted certificate, hostname mismatch, or other validation failure.
What the evidence shows
The scanner's TLS client could not validate the certificate presented for the scanned origin and recorded the validation reason.
Limits of this check
This is a transport-level probe, not a browser or application test. It does not inspect every hostname, client trust store, certificate chain configuration from every network, or application behavior after a connection succeeds.
How to fix it
Use the recorded validation reason
Identify whether the failure concerns expiry, trust, hostname coverage, or chain configuration. Correct the certificate and deployment configuration for the exact public hostname.
Automate renewal and monitoring
Use managed certificates or a reliable certificate-automation process and alert before expiry.
How to verify the change
Verify a fresh external TLS handshake
Test the exact public hostname from an external network after deployment.
Expected: The certificate validates for the hostname and normal clients connect without certificate errors.