# Resolve certificate verification failures at the TLS boundary

Coordinator DB's documented server listeners do not provide TLS. An HTTPS certificate-verification failure therefore belongs to the external proxy, gateway or tunnel used by the client. Identify that endpoint before changing database credentials or SQL settings.

## Check the client-facing name

Confirm that the URL hostname matches the certificate's covered names, the certificate is within its validity dates and the client trusts the issuing chain. Check the client's system time and whether an organizational proxy substitutes its own certificate. A test using an IP address can fail even when the certificate is correct for the DNS name.

Ask the owner of the external TLS endpoint to install a complete valid chain or provide the organization's trusted CA through the client's supported trust configuration. Do not make disabled certificate validation the permanent connection policy.

## Retest SQL separately

After TLS succeeds, check `/ping` and an authenticated SELECT. A later 401 is a database authentication problem rather than a certificate problem. Verify that the proxy forwards the intended route and host information, especially for browser requests with Origin/Host checks.

Record the redacted hostname and certificate error; do not include private keys or database passwords in a report.

See [HTTP transport and authentication](https://coordinatordb.com/docs/concepts/features/interfaces/http) and [listener configuration](https://coordinatordb.com/docs/reference/settings/server-settings/settings/listen).