Use this article when users see a browser warning after VaultPilot HTTPS is enabled.
Identify the warning source first
- Confirm the public host in Server settings is the DNS name or IP users actually open. VaultPilot checks the certificate against that value only; another alias users type is not covered.
- Check the certificate validity dates and the server clock.
- Confirm the chain reaches a root CA that client devices trust. VaultPilot cannot decide that trust for your organization.
- VaultPilot rejects a CA certificate used as the server certificate. If the certificate lists intended purposes, one of them must be Server Authentication.
- Confirm public host, port, DNS, firewall and any reverse proxy all lead to the same server.
Validate bundle in Server settings checks that the PFX/P12 opens with the passphrase, contains the server certificate and its matching private key, is within its validity dates, loads for HTTPS, is not a CA certificate, allows Server Authentication and matches the current public host. It cannot check client trust: whether a user’s device trusts the issuing CA.
Upload errors
Certificate upload is Owner-only. Upload exactly one .pfx or .p12 package, not empty and no larger than 2 MB. Repeated failed uploads are paused for a while. Never send the package, passphrase or private key to anyone, including support.
| Error | Meaning | Next check |
|---|---|---|
| Unsupported file | The file is not .pfx or .p12. | Export the certificate and private key as a PFX/P12 package. |
| File size | The package is empty or larger than 2 MB. | Confirm the exported package size and retry. |
| Upload incomplete or too large | The upload did not arrive as one normal browser upload. | Retry from the VaultPilot screen with a single package of 2 MB or less. |
| Passphrase required | The package is protected but no passphrase was entered. | Enter the PFX/P12 passphrase in the matching field. |
| Passphrase invalid | The passphrase did not open the package. | Confirm the passphrase belongs to this package; never put it in a ticket. |
| Private key missing | The package has no private key. | Export a new PFX/P12 with the server certificate and its private key. |
| Private key mismatch | The private key does not belong to the certificate. | Rebuild the package from the correct certificate and key. |
| Server certificate missing | Only chain certificates were found. | Upload the server’s own certificate package, not a chain-only bundle. |
| Not yet valid / expired | The certificate is outside its validity dates. | Check the server time and the certificate’s valid-from and valid-to dates. |
| Public host invalid | The public host is empty or not a valid DNS name or IP. | Enter only a host name or IP in Server settings. |
| Host mismatch | The certificate does not name the configured public host. | Use a certificate issued for the host users open, or correct the public host. |
| CA certificate not allowed | The package holds a CA certificate instead of a server certificate. | Package the actual server certificate and its private key. |
| Server Authentication required | The certificate lists purposes but not Server Authentication. | Obtain a certificate issued for TLS server use from your CA. |
| Package unreadable | The package could not be opened or used for HTTPS. | Re-export it and recheck passphrase, key match and format. |
| Validation required | Settings were saved without a fresh validation. | Run Validate bundle before saving. |
| Validation expired | The validation expired, was already used, or belongs to another session. | Validate again in the same Owner session and save within 10 minutes. |
| Too many attempts | Several uploads failed in a short time. | Wait before retrying; repeated failures usually mean the wrong file type, an empty or oversized package, or the wrong upload tool. |
Validation and save are separate
Successful validation does not change live HTTPS settings. It holds the checked package for at most 10 minutes, for the same Owner only, and it can be saved once. Validate again when the package or passphrase changes, the time runs out, or someone else will save.
Settings saved means the package was checked again against the public host being saved and the change was applied in one step. It does not prove that clients already receive or trust the new certificate. Wait for any restart the screen asks for, then open the real HTTPS address from a separate client. A failed save leaves the previous certificate in place; if the address stops working unexpectedly, stop retrying and email support@vaultpilot.io.
Recommended support data
- Redacted host name.
- Port.
- Certificate subject and SAN summary.
- Validity dates and broad issuer type.
- The host, CA or Server Authentication error when present.
- Browser error message.
- VaultPilot error message and whether you validated again.
Related
Still stuck?
Check the troubleshooting guide, then write to support@vaultpilot.io with the version, the steps you took and the exact redacted error. Never attach passwords, vault exports or private keys.