Certificate URL Discovery - "Failed to retrieve certificate chain for URL" for some URLs

[Dinh Nguyen]

Hi Everyone,

I am testing Certificate Discovery using Discovery Schedule → Certificate URL in Certificate Inventory and Management.

I configured the URLs following the format mentioned in URL Certificate Discovery is not working for some URL's - Known Error, for example:

https://myurl.com

https://testsubdomain.myurl.com

The Discovery Schedule runs successfully overall, but for some URLs I consistently see the following log message: "Failed to retrieve certificate chain for URL: https://<url>". While other URLs are discovered successfully.

I would like to understand what are the common reasons that can cause the error?

Please someone help me.

Thank you so much.

[ayushraj7012933 · Accepted solution]

A successful Discovery Schedule only indicates that the job completed; it doesn't necessarily mean every URL was able to return its certificate chain.

The "Failed to retrieve certificate chain for URL" message can occur for several reasons, including:

• The target URL is unreachable from the MID Server due to firewall rules, proxy settings, DNS resolution issues, or network connectivity problems.

• The web server is not presenting the complete certificate chain (missing intermediate certificates).

• The URL redirects to another host that the MID Server cannot access.

• The server requires Server Name Indication (SNI), and the SSL handshake is not completed successfully.

• The server only supports older or unsupported TLS versions or has SSL/TLS handshake issues.

• The certificate has expired, is invalid, or the server is configured incorrectly.

• The target server restricts connections based on IP address or security policies.

As a first step, try accessing the same URL directly from the MID Server using tools such as OpenSSL, curl, or a web browser to verify that the complete certificate chain can be retrieved. Also, compare a working URL with a failing one to identify differences in DNS resolution, redirects, TLS version, or certificate configuration.

Reviewing the MID Server logs (agent0.log) along with the Discovery logs can also provide more detailed information about why the SSL handshake or certificate retrieval failed.