Fix HTTPS certificate errors in scenarios

Learn what the HTTPS certificate errors in your scenario mean and how to fix them.

When a module connects to a server over HTTPS, Make verifies the server's TLS certificate. If Make cannot verify the certificate, it blocks the connection and the module fails. Make does this to protect your data. An unverified connection can be intercepted or redirected to a different server.

These errors typically occur with apps that connect to a server that someone runs on their own infrastructure, for example a WordPress, Nextcloud, or FlexiBee instance. The server can belong to you, to your business partner, or to your customer. The owner of the server issues and manages its certificate, not Make.

Recognize the error

The failed module shows an error message like this:

The message contains:

• The address of the server that Make tried to connect to.

• The error code, for example DEPTH_ZERO_SELF_SIGNED_CERT.

• A short hint on how to fix the problem.

Find the error code in the list of error codes below.

Who can fix the error

Depending on the error code, the fix is either in your hands or in the hands of the server owner:

• You can fix it in the connection if the server uses a certificate that is valid, but not publicly trusted. This happens when the certificate is self-signed or issued by a private or corporate certificate authority (CA). You add the certificate to the connection, and Make trusts the server from then on.

• Only the server owner can fix it if the certificate on the server is broken, for example, it has expired, it was issued for a different address, or the server is misconfigured. Contact the server administrator and ask them to fix the certificate.

Make cannot bypass certificate errors that are caused by the server. Accepting a broken certificate would put your data at risk.

Tip: If you do not manage the server yourself, contact the person who does: your IT department, your hosting provider, or the administrator on your partner's or customer's side. They can give you the certificate or fix the server.

Certificate error codes

DEPTH_ZERO_SELF_SIGNED_CERT

What it means: The certificate is self-signed. No certificate authority issued the certificate. The server signed it itself. Self-signed certificates are common on internal systems, test environments, and devices in private networks.

Who can fix it: You.

How to fix it:

1. Get the server's certificate.

2. In Make, edit the connection that the module uses.

3. Select Advanced settings and paste the certificate into the Certificate field.

4. Save the connection and run the scenario again.

SELF_SIGNED_CERT_IN_CHAIN

What it means: The certificate's issuer is self-signed. The server's certificate was issued by a certificate authority that is not publicly trusted. The organization that runs the server usually operates this certificate authority itself.

Who can fix it: You.

How to fix it:

1. Get the certificate of the root certificate authority (CA). Do not use the server's own certificate. You need the certificate of the CA that issued it.

2. In Make, edit the connection that the module uses.

3. Select Advanced settings and paste the CA certificate into the Certificate field.

4. Save the connection and run the scenario again.

CERT_HAS_EXPIRED

What it means: The certificate has expired. Every certificate is valid only for a limited period of time. After that, it must be renewed on the server. Make does not accept expired certificates, even from a trusted certificate authority.

Who can fix it: The server owner.

How to fix it:

This is a configuration issue with the third-party server, not Make. Contact the server owner and ask them to renew the certificate. See what to send to the server owner.

When the certificate is renewed, run the scenario again. You do not need to change anything in Make.

ERR_TLS_CERT_ALTNAME_INVALID

What it means: The certificate was issued for a different DNS name. The address that Make connects to does not match any of the names listed in the certificate. For example, the certificate is issued for shop.example.com, but the connection points to example.com or to the server's IP address.

Who can fix it: You, if the address in your connection is wrong. Otherwise, the server owner.

How to fix it:

1. In Make, edit the connection that the module uses, and check the server address:

   • Check for typos in the hostname or URL.

   • Check whether the field expects only a subdomain (for example, mycompany) or the full domain (for example, mycompany.example.com).

   • Use the hostname if possible, not the IP address of the server.

2. If you made a change, save the connection and run the scenario again.

3. If the address is correct, the certificate on the server is issued for the wrong name. Contact the server owner and ask them to issue a certificate that includes the hostname you use. See what to send to the server owner.

UNABLE_TO_GET_ISSUER_CERT_LOCALLY

What it means: The certificate was issued by a certificate authority (CA) that Make does not trust. It is typically a private or corporate CA that an organization uses for its internal servers.

Who can fix it: You.

How to fix it:

1. Get the certificate of the root certificate authority (CA) that issued the server's certificate.

2. In Make, edit the connection that the module uses.

3. Select Advanced settings and paste the CA certificate into the Certificate field.

4. Save the connection and run the scenario again.

UNABLE_TO_VERIFY_LEAF_SIGNATURE

What it means: The server did not send its complete certificate chain, so Make could not validate the certificate.

Who can fix it: The server owner.

How to fix it:

This is a configuration issue with the third-party server, not Make. Contact the server owner and ask them to configure the server to send the full certificate chain. See what to send to the server owner.

When the server is fixed, run the scenario again. You do not need to change anything in Make.

Other certificate error codes

What it means: The certificate on the server is invalid for another reason. For example:

• CERT_SIGNATURE_FAILURE, UNABLE_TO_DECRYPT_CERT_SIGNATURE: The certificate's signature is invalid.

• INVALID_CA, INVALID_PURPOSE, PATH_LENGTH_EXCEEDED, CERT_CHAIN_TOO_LONG: The certificate chain is built incorrectly.

• CERT_UNTRUSTED, CERT_REJECTED: The certificate is not trusted for this purpose.

• ERROR_IN_CERT_NOT_BEFORE_FIELD, ERROR_IN_CERT_NOT_AFTER_FIELD, UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY, UNABLE_TO_GET_ISSUER_CERT: The certificate is malformed or incomplete.

Who can fix it: The server owner.

How to fix it:

In all these cases, this is a configuration issue with the third-party server, not Make. Contact the server owner and ask them to fix the certificate. See what to send to the server owner.

Get the certificate

To add a certificate to the connection, you need it in the PEM format. It is a text block that starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----. Always paste the whole block, including these two lines.

Which certificate you need depends on the error code:

• DEPTH_ZERO_SELF_SIGNED_CERT: the server's own (self-signed) certificate.

• SELF_SIGNED_CERT_IN_CHAIN, UNABLE_TO_GET_ISSUER_CERT_LOCALLY: the certificate of the root certificate authority (CA).

Ask the server administrator

The most reliable way is to ask the server administrator for the certificate. The administrator issued or installed the certificate, so they know which certificate is the right one.

A certificate in the PEM format is public information and does not contain any secret. Do not accept or share a private key (a block that starts with -----BEGIN PRIVATE KEY----- or similar). Make never needs it.

Download the certificate yourself

If you have access to a terminal on Linux or macOS, the following command downloads the last certificate that the server sends. Replace YOUR_DOMAIN.com with the hostname of the server:

openssl s_client -showcerts -connect YOUR_DOMAIN.com:443 </dev/null 2>/dev/null | \
awk '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/' | \
awk 'BEGIN{n=0}
     /BEGIN CERTIFICATE/{n++; out[n]=$0; next}
     /END CERTIFICATE/{out[n]=out[n] ORS $0; next}
     {out[n]=out[n] ORS $0}
     END{print out[n]}'

For a self-signed server certificate, the output is the server's certificate. For a server that uses a private CA, the output is usually the root CA certificate. Some servers do not send the root CA certificate at all. If the error persists after you add the downloaded certificate, ask the server administrator for the root CA certificate.

You can also export the certificate from your web browser. Open the server's address, click the padlock or the site information icon next to the address bar, and open the certificate details. Select the certificate you need, and export it in the PEM (Base64) format.

What to send to the server owner

If the server owner has to fix the error, send them the following information:

• The error code from the error message, for example CERT_HAS_EXPIRED.

• The server address from the error message.

• The date and time when the scenario failed.

• What needs to be fixed:

  • CERT_HAS_EXPIRED: renew the certificate.

  • ERR_TLS_CERT_ALTNAME_INVALID: issue the certificate for the hostname used in the connection.

  • UNABLE_TO_VERIFY_LEAF_SIGNATURE: configure the server to send the full certificate chain, including the intermediate certificates.

  • Other codes: check and fix the certificate installed on the server.

The server owner can verify the server's certificate configuration with a public tool, for example SSL Labs Server Test.

The connection has no Certificate field

Some apps do not offer the Certificate field in the connection's Advanced settings. If you need to add a certificate and cannot find the field, contact the Make Support.

For Custom Apps developers

If you are a developer of a Custom App, see HTTPS self-signed or with custom CA to learn how to add the field to your app.