Certificate looks fine but monitoring reports SSL errors
The most common cause: an incomplete certificate chain. Browsers fetch missing intermediate certificates automatically; curl (which WebCheck uses) doesn't — so it looks fine in your browser while our handshake fails.
#Troubleshooting
- Open the TLS diagnostic on the site detail page to see which handshake stage stalls (certificate, version, chain);
- Scan your site with SSL Labs or similar to check for missing intermediates;
- If all sites at once report SSL errors, it's the platform-side CA bundle — contact the platform to update
cacert.pem.
#Other mismatches
- Domain mismatch: the certificate's CN/SAN doesn't cover the hostname you entered (with/without
www.); - TLS version: the server only supports an old version that the client refuses by default — ask the site admin to upgrade;
- Node inconsistency: different vantage points get different certificates (multi-origin config drift) → verify node by node under Nodes & proxies.
Related: HTTPS certificate monitoring · Incident records