# Self-Healing CI: Recovering When a TLS Cert Chain Is Temporarily Unavailable

> A TLS verification failure from a temporarily unavailable chain or OCSP responder is a transient blip, not an invalid certificate. See the manual fix and how self-healing CI retries it.

Source: https://latchkey.dev/learn/self-healing-ci/self-healing-tls-cert-chain-unavailable  
Updated: 2026-06-26

A TLS verification that fails because an intermediate or revocation responder was briefly unreachable hit a transient blip, not an invalid certificate -- the same handshake verifies on a retry.

## What makes a failure safely retryable

Automatic retry is only correct for failures that are genuinely transient. Retrying a deterministic failure wastes minutes and hides a real defect, so the classification matters more than the retry mechanism.

- Safe to retry: network timeouts, registry 5xx, transient DNS failures, a service container that was not ready, a spot instance reclaimed mid-run.
- Not safe to retry: assertion failures, compile errors, lint violations, anything that fails identically on every attempt.
- Ambiguous, and worth investigating rather than retrying: out-of-memory kills, disk exhaustion, and flaky tests. These repeat under load and a retry only hides the trend.
- Always record that a retry happened. A pipeline that silently retries is a pipeline whose real failure rate you do not know.

## FAQ

### What causes Self-Healing CI: recovering when a TLS cert chain is temporarily unavailable?

A request fails TLS verification because part of the certificate chain (an intermediate fetched via AIA) or a revocation responder (OCSP/CRL) was temporarily unreachable. The certificate is valid and not revoked; a momentary blip prevented the chain or revocation check from completing. A human re-runs and the handshake verifies cleanly.

### How do I fix Self-Healing CI: recovering when a TLS cert chain is temporarily unavailable manually?

[object Object]

### Can Self-Healing CI: recovering when a TLS cert chain is temporarily unavailable be fixed automatically?

A temporarily-unavailable chain or responder has a recognizable transient signature -- a fetch/timeout failure in the verification path rather than an explicitly invalid or revoked certificate -- and the safe response is to retry.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt