dotvitals

Certificate could not be parsed

MediumConfirmedtls.certificate.unreadable

What this check looks for

The server sent something in place of a certificate that could not be read as one. No client can validate what it cannot decode.

Why it matters

A certificate that does not decode fails every connection, and it means the file on the server is damaged, truncated, or not a certificate at all.

When the check passes, your report says: “The certificate parses as a certificate”.

What it costs your score

When this check fails it removes 20 points from your TLS score, before the status, confidence and repeat multipliers are applied. TLS carries a weight of 15 in the overall score.

It shares the tls.certificate family ceiling of 60 points: however many findings that family produces, together they cannot remove more than that from TLS. One underlying problem showing up in several places is still one problem.

Severity
medium
Default confidence
confirmed
Status when triggered
fail
Deduction
20 points
Family cap
tls.certificate · 60
Category
TLS
Module
Tls certificate
Fix owned by
user
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Re-copy the certificate file from the CA and reload the server.

A certificate the parser cannot read is one no client can validate either.

  1. Verify the file locally: openssl x509 -in cert.pem -noout -text.

  2. Confirm it starts with -----BEGIN CERTIFICATE----- and is not the private key.

  3. Re-download from the CA if the file is truncated, then reload the server.

How to confirm it worked

  • openssl x509 -in /path/to/cert.pem -noout -subject — expect a subject line

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

nginx
openssl x509 -in /etc/ssl/‹host›/fullchain.pem -noout -text | head
Technical detail

Parsing the certificate for ‹host› failed: ‹parse error›. The usual causes are a PEM file that was truncated mid-copy, a private key pasted where the certificate belongs, a DER file served as PEM or the reverse, or a byte-order mark left in by an editor.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the tls certificate checkerBuild the fix

Other tls certificate checks