Certificate could not be parsed
Updated
None of the 923 domains we could check fail this. Sample: the first 1,000 domains by rank in the Majestic Million, checked on 2026-10-12. How we measured
What this check looks for
The server sent something in place of a certificate that could not be read as one. No client can validate what it cannot decode.
Why it matters
A certificate that does not decode fails every connection, and it means the file on the server is damaged, truncated, or not a certificate at all.
When the check passes, your report says: “The certificate parses as a certificate”.
What it costs your score
When this check fails it removes 20 points from your TLS score, before the status, confidence and repeat multipliers are applied. TLS carries a weight of 15 in the overall score.
It shares the tls.certificate family ceiling of 60 points: however many findings that family produces, together they cannot remove more than that from TLS. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 20 points
- Family cap
- tls.certificate · 60
- Category
- TLS
- Module
- Tls certificate
- Fix owned by
- user
- In the ruleset since
- 2026.09
How to fix it
Re-copy the certificate file from the CA and reload the server.
A certificate the parser cannot read is one no client can validate either.
Verify the file locally:
openssl x509 -in cert.pem -noout -text.Confirm it starts with
-----BEGIN CERTIFICATE-----and is not the private key.Re-download from the CA if the file is truncated, then reload the server.
How to confirm it worked
openssl x509 -in /path/to/cert.pem -noout -subject — expect a subject line
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Remediation by platform
openssl x509 -in /etc/ssl/‹host›/fullchain.pem -noout -text | headTechnical detail
Parsing the certificate for ‹host› failed: ‹parse error›. The usual causes are a PEM file that was truncated mid-copy, a private key pasted where the certificate belongs, a DER file served as PEM or the reverse, or a byte-order mark left in by an editor.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.