Troubleshooting¶

Feature-specific guidance also appears under certificate workflows, Delegated DNS-01, plugins and Entra ID. This page covers issues that cut across features.

Signing in¶

"Too many attempts. Wait a minute and try again."¶

The sign-in page allows 10 attempts per minute for one email address from one network address and 30 attempts per minute from one network address across all email addresses. Eight consecutive wrong passwords also lock the account for 15 minutes. Wait, then try again; the API's POST /api/v1/auth/login returns the same generic 401 Invalid email or password. while throttled.

The two-factor code is rejected¶

Check that the phone's clock is set automatically: a code is accepted only for about 30 seconds either side of its time step, and each code works once, so wait for the next code rather than entering the same one again. After five attempts within five minutes, further codes are refused until the window passes; ten failures in a row lock sign-in for 15 minutes. Use Use a recovery code instead if the app is not available. See Two-factor sign-in.

I lost my authenticator and my recovery codes¶

Ask an administrator of your workspace to Reset two-factor for your account on Users → Manage. You are signed out everywhere and can sign in with your password and set it up again. Administrators cannot reset their own; another administrator (or a tenant administrator) has to. See Administrator reset.

Every page sends me to "Account security", or the API answers "mfa-required"¶

Your workspace requires two-factor sign-in and your grace period has ended. Set it up under Account security; until then the dashboard offers nothing else and the API answers 403 mfa-required. Single sign-on users, demo accounts and API keys are not affected. An API session that signed in with a password and has not verified its code yet gets the same answer; call POST /api/v1/auth/mfa/verify first.

Every page sends me back to "Change password"¶

An administrator created or reset your account, so a password change is required before anything else. Until you change it, every other form submission is redirected to the password page. Demo accounts cannot change their password at all (This is a demo account, changing password is not supported.).

A federated (SSO) user can sign in but has no access¶

Role mapping is default-deny - see OIDC / SSO overview. Check that the claim value your identity provider actually sends matches a configured mapping (or a CertIntel.* convention value) exactly, byte for byte.

Signing out at the identity provider does not end the CertIntel session¶

Front-channel logout only takes effect when the provider's request carries both sid and iss and iss equals the Issuer configured on the provider exactly. For Entra ID that means the v2.0 issuer; see Entra ID troubleshooting. The session still ends on CertIntel's own Sign out or at expiry.

Agent¶

The agent says setup is required or cannot authenticate¶

Open Settings, supply either an install token or an existing agent API key, then select Test connection. A saved local credential is not proof that the platform accepted it:

• Approval required: Approve this agent in the CertIntel dashboard, then test the connection again. (428 Precondition Required) means an administrator must approve the newly enrolled device on the platform's Agents page. The same condition shows up as CertIntel HTTP 428 elsewhere; see below.
• 401 Unauthorized means the key is wrong, expired or revoked.
• This one-time install token has already been used. Mint a new one from the Install Tokens page. (401) - a one-time token enrolls exactly one agent, and this one already has; the first install consumed it. If that install was yours and the agent is now waiting for approval, nothing is wrong. Mint a new token for another machine (platform builds after 2026.10.28).
• This one-time install token has expired. Mint a new one from the Install Tokens page. (401) - the token's Expires after window (15 minutes to 24 hours) ran out before the install. Mint a new one; the organization token does not expire.
• Invalid install token. (401) - the token is mistyped, revoked, or the organization token has been rotated since the command was copied. The specific one-time messages above appear only when the secret matched.
• A network or TLS error means the configured API/server URL cannot be reached or trusted from the service host.

If you installed with the raw MSI, the agent has no credential at all: the MSI no longer accepts INSTALLTOKEN or APIKEY. Connect it from Settings or with certintel enroll.

Activity, diagnostics or a job shows "CertIntel HTTP 428"¶

The Agent enrolled successfully but has not been approved yet. Nothing is wrong with the key, the URL or the network: open the dashboard's Agents page, find the device with the pending approval badge and click Approve, then Test connection again. See Install tokens & enrollment.

• Agent 1.3.93 and later say so once: an approval-pending event (Waiting for administrator approval in the CertIntel dashboard (CertIntel HTTP 428 from ROUTE); Private CA, Internal TLS Probe - Cloud, AD CS and CRL cloud checks resume after approval), approval_pending: true in certintel status --json, private_ca.status pending, and a disabled waiting for administrator approval issuer entry in the wizards. When the approval is noticed, an approval-granted event follows (This agent was approved in the CertIntel dashboard; cloud checks resume and the Private CA availability is being checked) and the cloud checks and Private CA probe run at once.
• Agent 1.3.92 and earlier translate the status only in Test connection (Approval required …); every other refused request (heartbeat, reports, the Private CA probe, a certificate request) is recorded verbatim as CertIntel HTTP 428, including a Cloud check failed: CertIntel HTTP 428 entry per scan.

Use Activity for the readable error. Routine activity stays in the agent; only errors are written to the Windows Application event log (source CertIntelAgent), including CertIntelAgent service failed: … when the service cannot start. Debug entries are always recorded; show them with Show debug details on Activity. Retention is under Settings → Log retention.

The desktop app shows "View only" and nothing can be changed¶

The app runs without administrator rights until you approve changes. Click Unlock changes (or simply make a change) and accept the Windows prompt. The approval lasts until you click Lock, close the app, or 15 minutes pass without changes. A standard (non-administrator) Windows account cannot use the app at all; use Restart as administrator with an administrator account. See Administrator approval.

If the second confirmation dialog (CertIntel Agent - administrator approval) lists changes you did not make, choose No. After three refusals the helper closes and the next change asks for Windows approval again.

A workflow cannot change its CA, account or certificate names¶

This is intentional. The domain set, ACME account, directory/profile, key type and renewal identity are part of persisted order and replacement policy. The Agent rejects changes to these fields on an existing workflow.

Create a new workflow for a different issuance identity. Existing workflows can still change their display name, automatic-renewal preference, DNS credential, output password, and storage/installation plans.

Choosing the correct workflow action¶

Manual actions and first issuance run immediately. Weekly renewal windows constrain only unattended renewal and automatic installation retries. The Renewal due column and History… explain why a renewal has not happened yet.

A renewed certificate is issued but not installed ("Waiting for deployment window")¶

The certificate has a deployment window (its workflow's own or the Agent default), so the renewed certificate waits for the next opening while the current one stays installed. The desktop app shows Waiting for deployment window, the terminal interface the time it installs, and CertIntel lists it under Deferred deployments on the Agent's host detail. Install again installs it at once. If the installed certificate would expire within the window's margin before the next opening, the Agent installs anyway and CertIntel raises Deployment window overridden.

The renewal date moved, or a certificate renewed early¶

Since Agent 1.4.0 the Agent follows the CA's renewal window (ARI) when the CA offers one, and picks a random time inside it. When the CA moves the window earlier or reports that it has already ended - for example ahead of a mass revocation - the Agent renews on its next pass, outside renewal windows too. The Renewal due tooltip, the terminal interface's certificate detail and the certificate's Renewal schedule in CertIntel show the basis and the window. See when a certificate renews.

"HTTP-01 is no longer supported"¶

HTTP-01 was removed in Agent 1.5.0. A certificate created with HTTP-01 on Agent 1.4.x keeps its installed certificate but is no longer renewed, and shows HTTP-01 is no longer supported (removed in Agent 1.5.0); delegate DNS-01 for these names and remove the challenge setting. Create a DNS delegation for its names, then use Switch to DNS-01 (see HTTP-01 was removed). In the dashboard, HTTP-01 is no longer supported; use DNS-01 delegation. means an assignment or API request still names an HTTP-01 challenge; omit challenge.

A dashboard assignment shows "Blocked by configuration lock"¶

A local administrator turned on the Agent's configuration lock, so the Agent applies no dashboard assignment until it is turned off on the device; the assignment stays awaiting approval with Configuration lock is on; platform changes are blocked on this agent. Ask the device's administrator to run certintel unlock (elevated, or with sudo) or turn it off in the desktop app's or terminal interface's settings, then approve the assignment there. Proposals that arrived during the lock are never auto-applied. See configuration lock.

The desktop app's "Lock" button and the configuration lock¶

They are unrelated. Unlock changes and Lock start and end the desktop app's administrator approval session. The Configuration lock under Settings (Agent 1.4.0 and later) is a file that makes the service refuse dashboard-assigned workflows. See Configuration lock.

An endpoint is "serving an old certificate"¶

The endpoint is linked to a managed certificate that renewed more than the grace period (24 hours by default) ago, and its last probe still saw the previous certificate. The renewed certificate was usually installed somewhere else than the server that answers - another node behind a load balancer, a CDN or proxy in front, or a site whose binding was not updated - or the service was not reloaded. Fix the deployment; after the next probe the status and the Endpoint still serving an old certificate alert clear on their own once the endpoint serves the renewed certificate. If the link is wrong, Unlink it on the endpoint. See Served versus issued.

A failed installation alert shows "[redacted]" or no output¶

The Agent replaces every secret it knows of with [redacted] before sending a failed step's output. No output at all means the failure came from an Agent before 1.4.0, another ACME client, a failure before installation, or an Agent or workflow with report_step_output turned off. See Reporting failed step output.

A workflow setting, step output, or secret is missing¶

Open Edit workflow… → Edit workflow settings and steps… → Review. Missing shared settings belong on Setup; secret names belong on Advanced, with their values saved separately through Protected secrets…. Use Insert value… to select references. Moving a producer below its consumer breaks the reference, and a skipped or failed producer cannot supply its normal outputs. See the studio guide.

A message such as input "name" cannot use runtime-derived reference means a ${steps.*}, ${certificate.*}, ${renewal.*} or ${system.*} value was used to build a path, file name, host or other target. Use a literal or a shared setting there; see where runtime values may be used.

Validate with agent checks the definition without running it. A successful validation does not prove a secret is stored, a directory exists, or a service is reachable. Validate / preflight performs the supported non-installing checks on a saved workflow; check actual job results after execution.

A replaced certificate remains in the Windows store¶

By default the Evaluate previous Windows store certificate step verifies the replacement and then retains the predecessor (retained: true, reason: acknowledgement_required), because the Agent cannot prove that every Windows consumer has switched. Removal happens only when both shared settings Remove previous certificate after confirmation and No other application uses the previous certificate are on and no IIS, HTTP.sys or Remote Desktop binding still references the old certificate (reason: in_use otherwise). The scheduled Purge of superseded store certificates under Settings → Schedules is a separate, off-by-default sweep. Otherwise remove the old certificate from certlm.msc yourself once you are sure nothing uses it. See Windows store verification.

JKS issuance or installation fails¶

Confirm that the workflow points to the exact absolute .jks file, the Java runtime's real keytool.exe, the intended alias, and the existing keystore/key password. The containing application directory must already exist. A JKS password must be supplied because Java must be able to open the keystore after the agent writes it.

If keytool reports an invalid CSR, inspect Activity for the command phase and verify that the selected executable is Java keytool, not another file with the same name. If certificate import completed but the selected Tomcat/Windows service did not restart, use Install again. The agent recognizes an already imported reply and continues with the exact configured service restart instead of trying to create another certificate order.

A Windows update is offered but will not install¶

The updater accepts a release only when its two signed metadata sources agree and their authorization has not expired. It also verifies exact size, the MSI SHA-256 digest, Authenticode signer and MSI product identity before starting Windows Installer, and never installs an older version. Check Activity for a source-disagreement, signature, hash or installer error (update-failed). A transient disagreement can mean one release endpoint has not finished publishing; retry after both endpoints contain the same release.

Use the current release URLs; the assets record is downloads/agent/latest/info.json. Records are re-signed on a schedule and expire after 30 days, so check the machine clock if the record appears expired or from the future. An update that starts but rolls back can have failed the installed-version or service-health check; inspect C:\ProgramData\CertIntelAgent\update-install.log and the resulting service status instead of treating launch as a successful upgrade.

On Linux, run certintel update check and sudo certintel update install. Agent 1.5.0 and later also check for updates on their own and show update available, but automatic installation on Linux is not available in this release, and deb or rpm installations update through apt or dnf. See Linux updates.

"Update now" or "Update all outdated" did not update an Agent¶

The dashboard only requests an update; the Agent picks the request up with its next heartbeat (within about an hour) and decides. The Agent's row or host page shows the state and the reason (see Agent updates from the dashboard):

The configuration lock does not block signed updates.

An appliance deployment fails¶

See Appliance deployment. The appliance templates were tested against simulated APIs, not real devices, so also check the details listed for your template there.

• credential not set: certintel secret set remote … - the workflow uses a local credential that was never set. Set it on the Agent machine with certintel secret set remote WORKFLOW-ID:credential (elevated or sudo), or have the assignment name a platform credential.
• the management certificate (SHA-256 …) does not match the pinned fingerprint - the appliance's management certificate changed. Compute the new fingerprint (how) and update the pin. Nothing was sent to the device.
• … already holds a different certificate named … - choose another Certificate name on the device, or remove the old object on the device.
• Configuration lock is on; platform credentials are not fetched. or remote_credentials is not accepted on this agent … - platform credentials need the local opt-in and the lock off; see Platform credentials.
• The Agent's activity log says the platform refused a delivery with sealing-key-unapproved - the Agent reported a new sealing key (after a re-enrolment or certintel secret rotate-sealing-key). Approve it on the host page with Approve new key if you expect the change; see Sealing keys.

"starter hook certintel-KIND.sh is not installed"¶

A dashboard assignment of a Linux service template (for example haproxy-standard) needs the root starter hook on the host first. Run sudo certintel hooks starter KIND --write (or set the service up once in sudo certintel tui), check the paths in the written script, then send the assignment again. The template's Agent folder must also be a folder the Agent may write; prepare it once with sudo certintel tui. See Linux service targets.

A Microsoft service step fails¶

The Microsoft service templates were not verified on a live server. A failed binding step binds the previous certificate again. Check the message against the template's prerequisites, for example Reporting Services has no SSL binding on IP:PORT. Add the HTTPS URL in Report Server Configuration Manager first., There is no WinRM HTTPS listener at address … or The Routing and Remote Access VPN role is not installed and configured.

Server detection says "Read-only session"¶

On Linux, server detection runs only in the terminal interface started as root: sudo certintel tui. The service and the desktop path never run it. See Server detection.

Internal endpoints assigned in CertIntel are never checked¶

Platform-assigned checks are on by default only for agents first installed on 1.3.79 or later; upgrading an older agent keeps its saved setting, which was off by default. Turn on Check internal endpoints assigned by CertIntel on the agent Overview (Windows) or with m on the Linux terminal interface's Agent Monitors screen, approve the change, and confirm the Internal endpoints assigned by CertIntel row under Settings → Schedules no longer says Disabled. The agent must also be registered or enrolled; an unconnected agent never polls.

The "CertIntel Private CA" choice does not appear, or is disabled, in the Agent¶

The Agent offers a Private CA only when the platform answers its availability probe with a list of CAs. Run certintel status --json and read private_ca.status and private_ca.detail: forbidden means the Agent's key has not been allowed to request certificates (an administrator turns on Allow private CA on the Agents page or Who may request certificates on the CA page) or the subscription lacks the feature; pending (Agent 1.3.93 and later) means the Agent itself is still waiting for approval; unsupported means an older platform; available with no CAs means no CA in the organization is active yet.

Agent 1.3.93 and later show the entry disabled with the reason instead of hiding it (not allowed for this agent (ask an administrator to Allow private CA), waiting for administrator approval, no active issuing CA is offered to this agent yet, availability unknown (see certintel status --json)), and notice an Allow private CA granted shortly after approval within about a minute; Agent 1.3.92 and earlier hide it and re-check hourly. Both pick a change up immediately with certintel private-ca refresh or a service restart; the full sequence (approve, allow, refresh) is under Enabling it for an Agent.

A Private CA client certificate is not trusted on Windows, or hosts stay on a retiring CA¶

Agent 1.4 trusted a Private CA root on Windows for TLS server authentication only. After upgrading to Agent 1.5.0, run certintel private-ca trust CA-ID again from an elevated prompt (or Trust this CA on this computer…) so the root is trusted for TLS server and client authentication. The CA page's Trust on hosts matrix shows Trusted (server only) for hosts that still need it; see Trust status on hosts.

When a CA page says hosts are still renewed from this retiring CA (needs Agent 1.5.0 or unlock to follow rotation), those Agents are older than 1.5.0 or have the configuration lock on. They keep renewing from the retiring CA until it expires; update or unlock them. A successor under a different root needs certintel private-ca accept-rotation CERTIFICATE-ID on the device. See Rotation.

A dashboard assignment shows "Rejected" with a reason from the agent¶

The Agent refused the proposal before anyone on the device saw it (decided by agent). The reason names the first failing rule: the template is not bundled with that Agent or not available on its operating system, its version differs from the one the dashboard offered (the Agent was updated after its last capabilities report), a variable is unknown or has the wrong type, the certificate id already exists on the device, a name is invalid for the issuer, the Private CA is not an active CA that Agent may use (CertIntel Private CA issuance is not available to this agent (status forbidden) - see enabling it for an Agent), the ACME account is not configured on the Agent, or the document carried something assignments cannot contain (unsupported assignment document: …). A re-sent revision of an assignment the device had already approved is refused too: create a new assignment instead of re-sending this one. Fix the proposal and create a new assignment; the Agent's Activity shows the same reason under assignment-rejected. A Rejected with decided by administrator is a person's decision on the device, with the reason they typed.

Approving a dashboard assignment answers "conflict: revision N was reviewed but revision M now awaits approval"¶

Between your review and your approval the dashboard re-sent the assignment with changes, so the Agent refused to apply what you had not seen. Open the assignment again (Details, enter in the terminal interface, or certintel assignments show ID), check the new proposal and approve or reject it again. The related conflict: the configuration changed while the assignment was being applied; approve it again means another configuration change landed at the same moment; simply approve again. Both leave the proposal awaiting approval; nothing was written. In the desktop app the same situation means the list is older than the proposal: refresh it, open the assignment again and decide on the new revision.

certintel assignments approve says it "needs --revision N"¶

The command could not ask you to confirm: it ran without an interactive terminal (a script, an RMM tool, a redirected input) or with --json. Review the proposal with certintel assignments show ID; its last line is the exact command, certintel assignments approve ID --revision N, that approves the revision you just read. In an interactive elevated prompt approve ID without --revision shows the proposal and asks [y/N] instead.

The desktop app says an assignment "is too long to review in the approval dialog"¶

The administrator approval dialog shows every character of what it approves, and this proposal does not fit its pages. Nothing was approved. Open a prompt with Run as administrator, read the whole proposal with certintel assignments show ID, and approve it with the certintel assignments approve ID --revision N command the app (and show) names. Long single settings alone do not cause this: they are shown in numbered parts in the dialog.

Approving answers "unavailable: the CertIntel Private CA availability could not be confirmed"¶

The assignment names a CertIntel Private CA, and at that moment the Agent could not tell whether it may use it: it has not checked the Private CA yet with its current key, the last check failed, or its approval is pending. The proposal is fine and stays awaiting approval; check certintel private-ca list (or certintel status --json → private_ca.status; certintel private-ca refresh checks now) and approve again in a few minutes. The same situation keeps a newly sent Private CA assignment Pending in the dashboard until the Agent's next successful check.

The Agent's activity log says "Automatic application of dashboard-assigned workflows was turned off"¶

The Agent's auto-apply consent belonged to another connection: it was registered or enrolled with a different platform address, or the service started with a configuration whose consent names another platform than the one configured (or no valid organization). The Agent turned auto-apply off instead of applying proposals from a platform nobody consented to. If this platform should apply assignments without a local approval, turn auto-apply on again (certintel assignments policy --auto-apply on, the desktop checkbox or A in the terminal interface).

A dashboard assignment stays "Applying" with "issuance is being retried after a failed attempt"¶

The certificate and workflow were created, but the first Issue now attempt failed for a reason the Agent retries on its own: DNS propagation, a CA rate limit or a CA outage. The Agent's scheduled renewal pass retries; when the certificate is issued and the workflow delivered the assignment turns Applied with the thumbprint, and when the order is held (a policy rejection or exhausted attempts) it turns Failed with issuance stopped after repeated failures. Follow the certificate on the device meanwhile; see DNS troubleshooting for the common cause. The assignment settles at the Agent's next check after the pass.

The Agent's activity log says "the auto-apply policy no longer covers this assignment"¶

Auto-apply was turned off, or re-bound to another organization or platform, while a check was in flight. The proposal was not applied and now awaits a local approval like any other; approve or reject it on the device. Proposals that were already awaiting approval when auto-apply was turned on are never applied retroactively either, nor are the ones in the first list the Agent fetches after a reinstall or a new key. A proposal fetched by certintel assignments refresh or Check now is applied at the Agent's next own check, within about 5 minutes, not by the refresh.

A dashboard assignment shows "Failed"¶

Approval happened on the device but the Agent could not finish. If the message starts with the certificate and workflow are configured, but the issuance job failed or issuance stopped after repeated failures, the certificate and workflow exist; open the certificate on the device (or certintel jobs get ID --json with the job id from the assignment) for the ACME or Private CA error and issue again from there. Any other message means nothing was written: the Private CA was disabled or forbidden between approval and apply, or the merged configuration was invalid. A busy service or a storage error while saving does not fail the assignment; it stays awaiting approval and you approve it again. Create a new assignment once the cause is fixed; a failed one is final.

A dashboard assignment stays "Pending", or shows "Cancelled" or "Expired"¶

Pending means the Agent has not fetched it yet. It checks every 5 minutes, and within a minute for 15 minutes after approval; run certintel assignments refresh on the device or restart the service to check now, and read certintel status --json → dashboard_assignments.status: unsupported is an older platform (checked again every six hours), pending means the Agent itself awaits approval on the Agents page, error carries the last network or server error in detail. Cancelled was a dashboard user's action before the device applied it; Expired means nobody approved within the assignment's lifetime (30 days by default). Both are final on the platform; on the device the record is closed without a report. If the device approved at the same moment the dashboard cancelled, the device wins and the state moves to Applied or Failed with an after cancel mark; other reports that arrive after a cancel or expiry show in the timeline as changing nothing. A Private CA assignment can stay Pending while the Agent cannot yet confirm that it may use the Private CA (see the unavailable entry above). Re-sending or cancelling an assignment whose lifetime has just run out is refused because it turns Expired first; create a new one.

The Agents row says "Agent too old" or "Waiting for the agent's capabilities report"¶

Assign workflow needs Agent 1.3.95 or later. Waiting for the first heartbeat means the device has never reported; Agent too old: update to 1.3.95 or later goes away after the update (it also appears for a client that is not the CertIntel Agent). Waiting for the agent's capabilities report; it is sent within minutes of approval means the Agent is new enough but has not yet told the platform which templates, accounts and delegated names it has; it does so on its first check after approval and whenever they change. If it stays, run certintel assignments refresh on the device and check certintel status --json → dashboard_assignments for unsupported (the platform does not offer the feature yet) or an error detail.

The Agent's activity log says "The platform refused the … report for dashboard assignment …"¶

The device decided (assignment-report-refused), but the platform would not record the report: the assignment was deleted or belongs to another key (404), a newer revision or a terminal state already exists there (409), or the body was malformed (422). The local outcome stands - a created certificate and workflow stay on the device - and the dashboard keeps the state it had. One refusal is expected: when the dashboard re-sent an assignment while it was being approved on the device, the platform keeps the revision the device applied, so the Agent's refusal of the re-sent revision is answered 409. Compare certintel assignments list --all with the assignment's timeline; re-create the assignment if the dashboard must reflect the device.

validate --file or config apply --file reports "malformed JSON" for a valid file¶

With Agent 1.3.92 and earlier the file most likely starts with a byte-order mark. In Windows PowerShell 5.1, Out-File -Encoding utf8 and Set-Content -Encoding UTF8 write a UTF-8 BOM and > redirection writes UTF-16; those releases reject both as a bare malformed JSON before reading any field. Check with Format-Hex C:\certintel\config.json | Select-Object -First 1 (a BOM shows as EF BB BF, UTF-16 as FF FE) and write the file again without one: -Encoding ascii for ASCII-only content, [IO.File]::WriteAllText($path, $json, [Text.UTF8Encoding]::new($false)), or PowerShell 7 (pwsh), whose Out-File and > default to UTF-8 without a BOM. See Command-line configuration.

Agent 1.3.93 and later accept a UTF-8 BOM (UTF-16 is still refused) and point at the actual problem: malformed JSON at line L, column C: reason for a syntax error, or invalid JSON fields or types at line L, column C: … for an unknown field or a value of the wrong type.

The Windows uninstall fails with "CertIntel data erasure was incomplete"¶

You chose to remove all data (or passed REMOVEALLDATA=1) and a folder or registry key could not be deleted, often because a file is open or permissions were changed. The uninstall stops rather than leaving protected data behind silently. Close programs using C:\ProgramData\CertIntelAgent, fix permissions, and retry the uninstall with REMOVEALLDATA=1.

API and dashboard¶

"401 Unauthorized" with no other detail¶

CertIntel deliberately gives the same generic 401 for a wrong secret, a revoked key, and an expired key - there's no way to distinguish them from the response, so a leaked key prefix can't be used to probe a key's state. Check, in order:

1. Is the key/prefix actually the one you think it is? Compare against the API Keys or Agents page.
2. Has it expired or been revoked? Both show clearly in the dashboard even though the API response doesn't distinguish them.
3. For an agent key specifically: is it still pending approval? See Install tokens & enrollment - a pending key returns a distinguishable 428, not a 401, so if you're seeing a plain 401 the key isn't the pending-approval case.
4. For an install-token exchange: the generic message is Invalid install token.; a one-time token whose secret matched says instead that it has already been used or has expired (see the agent cannot authenticate).

POST /api/v1/auth/logout also returns 401 Authentication required. when called without a session or key.

"404 Not Found" for something you're sure exists¶

CertIntel answers a cross-tenant or cross-organization id with 404, never 403 - this is deliberate, so a permission boundary never reveals whether something exists on the other side of it, only that you can't see it. If you're confident the resource exists, check that you (or the API key) are scoped to the right organization, and that a tenant-wide/organization-switcher filter isn't hiding it. An organization administrator also gets 404 for users who hold tenant-wide authority.

"422 Request validation failed." from a reporting script¶

A field exceeded its size limit and the whole request was rejected; nothing was stored. The response lists the field and message, for example String should have at most 32768 characters for log_output. Truncate before sending. The limits are listed under ACME check-ins & renewals and Internal certificate scanners.

A write-scoped key can't do something it should be able to¶

A write key does not grant general inventory reads or target management; specific Agent identity/policy and collection-assignment endpoints remain available as authorized by the server. If it also looks like it can't submit a specific kind of report, check whether it was narrowed to a subset of renewals / checkins / internal_certs at creation - see API keys & authentication.

An organization administrator can't see something a tenant administrator can¶

This is usually correct behavior, not a bug: most resources are scoped to one child organization, and an organization-level role only ever sees its own organization's data - even tenant-wide (organization-less) resources are invisible to it. Tenant-wide visibility requires tenant administrator authority.

"This target cannot be monitored (resolves to a non-public or otherwise special-use address)."¶

Public endpoints, alert destinations and identity-provider discovery URLs must resolve to public internet addresses. Private ranges, loopback, link-local and carrier-grade NAT (100.64.0.0/10, used by Tailscale) are refused. A public endpoint with such an address is still created, but every check records this message instead of a probe result; identity-provider discovery reports URL host is not allowed (non-public/special-use address). Monitor internal hosts with an Agent's internal endpoints instead.

"The last active tenant administrator cannot be disabled." (or "...demoted.")¶

A tenant must always keep one active tenant administrator, and you cannot disable or demote yourself. Promote a successor first, then disable or demote the original account.

A site shows "not graded" or "Key exchange group unknown"¶

A site's TLS grade needs a captured certificate and at least one negotiated protocol version; it is assessed within an hour of a successful check, then once a day. Key exchange group unknown means CertIntel's own client could not see the negotiated group; it does not affect the grade. TLS 1.0 and 1.1 are tested only when you turn on Test TLS 1.0/1.1 too for that site.

CSV cells start with an apostrophe¶

Exported CSV cells that begin with =, +, -, @, a tab or a line break are prefixed with ' so a spreadsheet cannot interpret them as formulas. Spreadsheets hide the apostrophe; strip it in scripts if needed.

DNS-01 challenge never resolves¶

Almost always one of:

• The CNAME target was copied with a stray trailing character, or without the trailing dot some DNS providers require - use the copy button on the delegation record rather than retyping it. CertIntel's DNS answers only for the exact 32-character label it generated; anything else is NXDOMAIN.
• Cloudflare: the record is proxied (orange cloud) instead of DNS only (grey cloud) - see Delegated DNS-01 (dashboard).
• The CNAME hasn't propagated yet - DNS propagation delay, not a CertIntel issue; wait out your provider's TTL.