> For the complete documentation index, see [llms.txt](https://developers.make.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers.make.com/custom-apps-documentation/other/fix-https-certificate-errors-in-scenarios.md).
# Fix HTTPS certificate errors in scenarios
Learn what the HTTPS certificate errors in your scenario mean and how to fix them.
When a module connects to a server over HTTPS, Make verifies the server's TLS certificate. If Make cannot verify the certificate, it blocks the connection and the module fails. Make does this to protect your data. An unverified connection can be intercepted or redirected to a different server.
These errors typically occur with apps that connect to a server that someone runs on their own infrastructure, for example a WordPress, Nextcloud, or FlexiBee instance. The server can belong to you, to your business partner, or to your customer. The owner of the server issues and manages its certificate, not Make.
## Recognize the error
The failed module shows an error message like this:
The message contains:
* The address of the server that Make tried to connect to.
* The **error code**, for example `DEPTH_ZERO_SELF_SIGNED_CERT`.
* A short hint on how to fix the problem.
Find the error code in the [list of error codes](#certificate-error-codes) below.
## Who can fix the error
Depending on the error code, the fix is either in your hands or in the hands of the server owner:
* **You can fix it in the connection** if the server uses a certificate that is valid, but not publicly trusted. This happens when the certificate is self-signed or issued by a private or corporate certificate authority (CA). You add the certificate to the connection, and Make trusts the server from then on.
* **Only the server owner can fix it** if the certificate on the server is broken, for example, it has expired, it was issued for a different address, or the server is misconfigured. Contact the server administrator and ask them to fix the certificate.
{% hint style="info" %}
Make cannot bypass certificate errors that are caused by the server. Accepting a broken certificate would put your data at risk.
{% endhint %}
{% hint style="info" %}
**Tip:** If you do not manage the server yourself, contact the person who does: your IT department, your hosting provider, or the administrator on your partner's or customer's side. They can give you the certificate or fix the server.
{% endhint %}
## Certificate error codes
### DEPTH\_ZERO\_SELF\_SIGNED\_CERT
**What it means:** The certificate is self-signed. No certificate authority issued the certificate. The server signed it itself. Self-signed certificates are common on internal systems, test environments, and devices in private networks.
**Who can fix it:** You.
**How to fix it:**
1. [Get the server's certificate](#get-the-certificate).
2. In Make, edit the connection that the module uses.
3. Select **Advanced settings** and paste the certificate into the **Certificate** field.
4. Save the connection and run the scenario again.
### SELF\_SIGNED\_CERT\_IN\_CHAIN
**What it means:** The certificate's issuer is self-signed. The server's certificate was issued by a certificate authority that is not publicly trusted. The organization that runs the server usually operates this certificate authority itself.
**Who can fix it:** You.
**How to fix it:**
1. [Get the certificate of the root certificate authority (CA)](#get-the-certificate). Do not use the server's own certificate. You need the certificate of the CA that issued it.
2. In Make, edit the connection that the module uses.
3. Select **Advanced settings** and paste the CA certificate into the **Certificate** field.
4. Save the connection and run the scenario again.
### CERT\_HAS\_EXPIRED
**What it means:** The certificate has expired. Every certificate is valid only for a limited period of time. After that, it must be renewed on the server. Make does not accept expired certificates, even from a trusted certificate authority.
**Who can fix it:** The server owner.
**How to fix it:**
This is a configuration issue with the third-party server, not Make. Contact the server owner and ask them to renew the certificate. See [what to send to the server owner](#what-to-send-to-the-server-owner).
When the certificate is renewed, run the scenario again. You do not need to change anything in Make.
### ERR\_TLS\_CERT\_ALTNAME\_INVALID
**What it means:** The certificate was issued for a different DNS name. The address that Make connects to does not match any of the names listed in the certificate. For example, the certificate is issued for `shop.example.com`, but the connection points to `example.com` or to the server's IP address.
**Who can fix it:** You, if the address in your connection is wrong. Otherwise, the server owner.
**How to fix it:**
1. In Make, edit the connection that the module uses, and check the server address:
* Check for typos in the hostname or URL.
* Check whether the field expects only a subdomain (for example, `mycompany`) or the full domain (for example, `mycompany.example.com`).
* Use the hostname if possible, not the IP address of the server.
2. If you made a change, save the connection and run the scenario again.
3. If the address is correct, the certificate on the server is issued for the wrong name. Contact the server owner and ask them to issue a certificate that includes the hostname you use. See [what to send to the server owner](#what-to-send-to-the-server-owner).
### UNABLE\_TO\_GET\_ISSUER\_CERT\_LOCALLY
**What it means:** The certificate was issued by a certificate authority (CA) that Make does not trust. It is typically a private or corporate CA that an organization uses for its internal servers.
**Who can fix it:** You.
**How to fix it:**
1. [Get the certificate of the root certificate authority (CA)](#get-the-certificate) that issued the server's certificate.
2. In Make, edit the connection that the module uses.
3. Select **Advanced settings** and paste the CA certificate into the **Certificate** field.
4. Save the connection and run the scenario again.
### UNABLE\_TO\_VERIFY\_LEAF\_SIGNATURE
**What it means:** The server did not send its complete certificate chain, so Make could not validate the certificate.
**Who can fix it:** The server owner.
**How to fix it:**
This is a configuration issue with the third-party server, not Make. Contact the server owner and ask them to configure the server to send the full certificate chain. See [what to send to the server owner](#what-to-send-to-the-server-owner).
When the server is fixed, run the scenario again. You do not need to change anything in Make.
### Other certificate error codes
**What it means:** The certificate on the server is invalid for another reason. For example:
* `CERT_SIGNATURE_FAILURE`, `UNABLE_TO_DECRYPT_CERT_SIGNATURE`: The certificate's signature is invalid.
* `INVALID_CA`, `INVALID_PURPOSE`, `PATH_LENGTH_EXCEEDED`, `CERT_CHAIN_TOO_LONG`: The certificate chain is built incorrectly.
* `CERT_UNTRUSTED`, `CERT_REJECTED`: The certificate is not trusted for this purpose.
* `ERROR_IN_CERT_NOT_BEFORE_FIELD`, `ERROR_IN_CERT_NOT_AFTER_FIELD`, `UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY`, `UNABLE_TO_GET_ISSUER_CERT`: The certificate is malformed or incomplete.
**Who can fix it:** The server owner.
**How to fix it:**
In all these cases, this is a configuration issue with the third-party server, not Make. Contact the server owner and ask them to fix the certificate. See [what to send to the server owner](#what-to-send-to-the-server-owner).
## Get the certificate
To add a certificate to the connection, you need it in the PEM format. It is a text block that starts with `-----BEGIN CERTIFICATE-----` and ends with `-----END CERTIFICATE-----`. Always paste the whole block, including these two lines.
Which certificate you need depends on the error code:
* `DEPTH_ZERO_SELF_SIGNED_CERT`: the server's own (self-signed) certificate.
* `SELF_SIGNED_CERT_IN_CHAIN`, `UNABLE_TO_GET_ISSUER_CERT_LOCALLY`: the certificate of the root certificate authority (CA).
### Ask the server administrator
The most reliable way is to ask the server administrator for the certificate. The administrator issued or installed the certificate, so they know which certificate is the right one.
{% hint style="info" %}
A certificate in the PEM format is public information and does not contain any secret. Do not accept or share a **private key** (a block that starts with `-----BEGIN PRIVATE KEY-----` or similar). Make never needs it.
{% endhint %}
### Download the certificate yourself
If you have access to a terminal on Linux or macOS, the following command downloads the last certificate that the server sends. Replace `YOUR_DOMAIN.com` with the hostname of the server:
```bash
openssl s_client -showcerts -connect YOUR_DOMAIN.com:443 /dev/null | \
awk '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/' | \
awk 'BEGIN{n=0}
/BEGIN CERTIFICATE/{n++; out[n]=$0; next}
/END CERTIFICATE/{out[n]=out[n] ORS $0; next}
{out[n]=out[n] ORS $0}
END{print out[n]}'
```
For a self-signed server certificate, the output is the server's certificate. For a server that uses a private CA, the output is usually the root CA certificate. Some servers do not send the root CA certificate at all. If the error persists after you add the downloaded certificate, ask the server administrator for the root CA certificate.
You can also export the certificate from your web browser. Open the server's address, click the padlock or the site information icon next to the address bar, and open the certificate details. Select the certificate you need, and export it in the PEM (Base64) format.
## What to send to the server owner
If the server owner has to fix the error, send them the following information:
* The error code from the error message, for example `CERT_HAS_EXPIRED`.
* The server address from the error message.
* The date and time when the scenario failed.
* What needs to be fixed:
* `CERT_HAS_EXPIRED`: renew the certificate.
* `ERR_TLS_CERT_ALTNAME_INVALID`: issue the certificate for the hostname used in the connection.
* `UNABLE_TO_VERIFY_LEAF_SIGNATURE`: configure the server to send the full certificate chain, including the intermediate certificates.
* Other codes: check and fix the certificate installed on the server.
The server owner can verify the server's certificate configuration with a public tool, for example [SSL Labs Server Test](https://www.ssllabs.com/ssltest/).
## The connection has no Certificate field
Some apps do not offer the **Certificate** field in the connection's **Advanced settings**. If you need to add a certificate and cannot find the field, contact the [Make Support](https://www.make.com/en/contact-support).
## For Custom Apps developers
If you are a developer of a Custom App, see [HTTPS self-signed or with custom CA](/custom-apps-documentation/other/https-custom-ca.md) to learn how to add the field to your app.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://developers.make.com/custom-apps-documentation/other/fix-https-certificate-errors-in-scenarios.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
