# TLS certificate validation errors

> Solutions for TLS certificate validation errors in Automation Suite.

If TLS certificate validation fails after updating the certificates in Automation Suite, refer to the following table to identify the cause and resolution.

| Error message (contains) | Cause | Resolution |
|---|---|---|
| `incomplete or untrusted certificate chain` | A missing intermediate certificate, or the chain does not lead to the provided root CA. | Put all intermediate certificates and the root CA in `ca.crt`. |
| `is not part of the leaf certificate's chain` | A certificate that did not issue the leaf is present (a sibling or unrelated intermediate, or a duplicate). | Ensure `server.crt` contains only the certificates from the leaf's actual signing chain — remove any sibling, unrelated, or duplicate CA certificates. Put the signing chain's intermediate(s) and root CA in `ca.crt`. |
| `certificates are not in the correct order` | Certificates are out of order. | Order them: leaf certificate, then intermediate(s), then root CA. |
| `leaf certificate does not match fqdn` | The leaf certificate's SAN omits the cluster FQDN, or `server.crt` does not start with the leaf. | Ensure `server.crt` begins with the leaf certificate and that the cluster FQDN is listed in its Subject Alternative Names. |

## Certificate requirements

To ensure TLS certificate validation succeeds, ensure the certificate files meet the following requirements:

* The `server.crt` file must contain the complete public server certificate chain in PEM format. The chain must start with the leaf server certificate, followed by the intermediate CA certificate(s), and then the root CA that form the signing path for that leaf certificate.
* The `server.crt` file must include only certificates that are part of the leaf certificate's actual signing chain. Do not include sibling, unrelated, duplicate, or alternate CA certificates, as TLS validation fails when certificates outside the leaf certificate's chain are present.
* The `ca.crt` file must contain the CA certificate bundle used to validate the server certificate chain, including the required intermediate CA certificate(s) and root CA. The `ca.crt` file must not include the leaf server certificate.