SSL Certificate Errors and Warnings

SSL Certificate Errors and Warnings

This article explains the SSL errors you might see in PulseAPI check history and how to resolve each one.

Common SSL Errors

SSL certificate expired

What it means: The certificate's validity period has ended. Browsers and PulseAPI both reject expired certificates.

Fix: Renew the certificate through your certificate authority (CA) or hosting provider. Most managed hosting platforms (AWS, Heroku, Netlify, etc.) handle renewal automatically — check your provider's documentation.

Prevention: Set up an SSL expiry alert rule with a 30-day warning.

SSL certificate hostname mismatch

What it means: The certificate was issued for a different hostname than the one you're monitoring. For example, a cert for www.yourapp.com will fail on api.yourapp.com.

Fix: Issue a new certificate that covers the correct hostname, or use a wildcard certificate (*.yourapp.com) if you're monitoring multiple subdomains.

SSL certificate untrusted / invalid chain

What it means: PulseAPI can't verify the certificate against a trusted root CA. This happens when:

  • The certificate is self-signed (common in dev/staging environments)
  • The intermediate certificate chain is incomplete (missing middle certificate)
  • The root CA is not in the standard trust store

Fix for self-signed certs: Disable SSL verification on the monitor (only appropriate for internal/staging endpoints you control). See Monitor Settings Reference.

Fix for incomplete chain: Install the full certificate chain on your server. Most SSL providers give you a "bundle" or "chain" file — ensure it's included in your server configuration.

SSL handshake failed / connection reset

What it means: A general TLS negotiation error. Can be caused by:

  • Mismatched TLS protocol versions (e.g., server only supports TLS 1.0)
  • Cipher suite incompatibility
  • Server-side TLS configuration error

Fix: Review your server's TLS configuration. PulseAPI supports TLS 1.2 and 1.3. If your server is restricted to older TLS versions, update its configuration.

When to Disable SSL Verification

Disable SSL verification only for:

  • Internal monitoring endpoints with self-signed certificates
  • Staging/dev environments where you're aware of certificate limitations

Never disable SSL verification for public production endpoints. If the cert is invalid, your users are getting browser security warnings.

To disable: edit the monitor → toggle SSL Verification off.

Related Articles

Still have questions? Contact support.

    • Related Articles

    • SSL Certificate Monitoring

      PulseAPI can monitor your SSL certificates and alert you before they expire. This article explains how SSL monitoring works and how to configure expiry alerts. How SSL Monitoring Works Every check PulseAPI makes to an https:// endpoint includes SSL ...

    • Alert Rule Conditions: SSL Certificate Expiry

      An SSL expiry alert rule fires when your monitor's SSL certificate will expire within a specified number of days. This gives you advance warning before your certificate expires and causes real failures. How It Works PulseAPI reads the SSL certificate ...

    • Glossary of Terms

      This glossary defines the key terms used throughout PulseAPI and this Help Center. Alert Rule A condition you configure that tells PulseAPI when to create an incident and send a notification. Each rule has a condition type (status code, response ...

    • My Monitor Shows Down But My Site Is Up

      If PulseAPI reports your monitor as down but you can access the site normally in your browser, there are several common explanations. This article walks through the most likely causes. Most Common Causes 1. PulseAPI's Check Location vs. Your Location ...

    • FAQ: Billing

      Answers to common questions about PulseAPI billing and plans. Can I try PulseAPI for free? Yes. The Free plan is available with no credit card required. It includes up to 10 monitors, email notifications, and 7-day check history. See Plans and ...