FIELD GUIDE / TROUBLESHOOTING · 5 MIN READ

Fix the Certificate Problem You Actually Have.

Start with the exact error, requested hostname, checked time and selected endpoint. Changing file extensions or disabling validation rarely fixes the underlying issue.

The Private Key Is Missing

A certificate or P7B cannot recreate its private key. Locate the original request’s key or the Windows user/machine store where it was generated. If the key is lost, generate a new key and request a replacement certificate. If it may be exposed, follow your CA’s revocation process as well.

The Certificate and Key Do Not Match

Use the public-key fingerprint comparison. A newer request may have created a different key. Stop rather than trying unrelated keys or renaming files until an import happens to succeed.

The Issuer Chain Is Incomplete

Check the leaf issuer and obtain the matching intermediates from the CA. Cross-signed paths can differ. Test against the intended root and inspect what the actual service presents; a correct local bundle does not prove the web server loaded it.

The Hostname Does Not Match

Check Subject Alternative Names, the requested apex versus www name, and SNI configuration. Ensure the virtual host or load balancer selects the correct certificate. Reissue with the required names when necessary; a file conversion cannot add them.

The Date Is Wrong or Renewal Looks Stale

Check system time first. Confirm which certificate is bound to the running service and whether the CDN terminates TLS separately. Renewal, deployment and successful reload are separate steps. Test the live endpoint after renewal rather than relying only on the certificate file’s date.

The PFX Will Not Import

• Confirm the password and run a no-output PFX inspection.
• Confirm the destination supports the PFX encryption algorithms.
• Verify that the input contains the matching private key and expected chain.
• For Windows exports, check HasPrivateKey and whether the key was made exportable.
• Check service-account permissions and the intended user versus machine store.

Older products may not support modern OpenSSL 3 PFX defaults. Prefer updating the product or following its current vendor instructions. Legacy export modes weaken protection; do not make them your default or disable certificate validation as a workaround.

The Checker Cannot Connect

This service allows only public DNS hostnames on port 443. Private, local, reserved and origin-management addresses are blocked. A check can also time out or be refused by the destination. Do not interpret a missing result as a successful or failed trust check.

What to Send to Support

Share the hostname, exact public error, timestamp, relevant certificate fingerprints and the non-secret report. Never send a private key, PFX file or password to [email protected]. We can correct the tool or guide; the website operator or CA must change the certificate.