TLS certificate validation errors

Solutions for TLS certificate validation errors in Automation Suite.

If TLS certificate validation fails after updating the certificates in Automation Suite, refer to the following table to identify the cause and resolution.

Error message (contains)	Cause	Resolution
incomplete or untrusted certificate chain	A missing intermediate certificate, or the chain does not lead to the provided root CA.	Put all intermediate certificates and the root CA in ca.crt.
is not part of the leaf certificate's chain	A certificate that did not issue the leaf is present (a sibling or unrelated intermediate, or a duplicate).	Ensure server.crt contains only the certificates from the leaf's actual signing chain — remove any sibling, unrelated, or duplicate CA certificates. Put the signing chain's intermediate(s) and root CA in ca.crt.
certificates are not in the correct order	Certificates are out of order.	Order them: leaf certificate, then intermediate(s), then root CA.
leaf certificate does not match fqdn	The leaf certificate's SAN omits the cluster FQDN, or server.crt does not start with the leaf.	Ensure server.crt begins with the leaf certificate and that the cluster FQDN is listed in its Subject Alternative Names.

Certificate requirements

To ensure TLS certificate validation succeeds, ensure the certificate files meet the following requirements:

• The server.crt file must contain the complete public server certificate chain in PEM format. The chain must start with the leaf server certificate, followed by the intermediate CA certificate(s), and then the root CA that form the signing path for that leaf certificate.
• The server.crt file must include only certificates that are part of the leaf certificate's actual signing chain. Do not include sibling, unrelated, duplicate, or alternate CA certificates, as TLS validation fails when certificates outside the leaf certificate's chain are present.
• The ca.crt file must contain the CA certificate bundle used to validate the server certificate chain, including the required intermediate CA certificate(s) and root CA. The ca.crt file must not include the leaf server certificate.