bonus.bimi.vmc_invalid

BIMI Evidence Certificate Invalid

What we check

When the BIMI record carries an a= tag, we fetch the evidence document and validate its structure: the body must be a parseable PEM certificate chain, and the leaf certificate must carry the BIMI logotype extension (OID 1.3.6.1.5.5.7.1.12, RFC 9399) — the extension that embeds the verified logo and makes a certificate a Verified Mark Certificate rather than an ordinary one.

What this finding means

The document at the a= URL is reachable but is not a structurally valid VMC. The finding names which check failed:

Not a parseable PEM chain — the URL serves something other than PEM certificates (an HTML error page and a DER-encoded file are common causes).
Missing the logotype extension — the file is a real certificate, but an ordinary one; without the logotype extension no mail provider will treat it as mark evidence.

Either way, providers that require a VMC will not display the BIMI logo.

How to fix

Serve the full PEM chain exactly as issued by your mark-verifying authority — not a DER file, not just the leaf, and not a different certificate.
If the URL serves an HTML page, fix the web server route: the a= URL must return the raw PEM document.

How it's graded

Informational — the VMC checks carry no score weight. See Grading Methodology for the full scoring model.

Evidence example