diff --git a/backend/src/services/health.ts b/backend/src/services/health.ts
index 5c0cc46..9c241cd 100644
--- a/backend/src/services/health.ts
+++ b/backend/src/services/health.ts
@@ -1,4 +1,5 @@
 import dns from 'node:dns/promises';
+import type { MxRecord } from 'node:dns';
 import tls from 'node:tls';
 import { pool } from '../db.js';
 import { config } from '../config.js';
@@ -110,7 +111,7 @@ async function dnsResolve(host: string, type: 'A' | 'AAAA' | 'MX' | 'TXT' | 'CNA
     if (type === 'A')     return await withTimeout<string[]>(dns.resolve4(host), 5000, `A ${host}`);
     if (type === 'AAAA')  return await withTimeout<string[]>(dns.resolve6(host), 5000, `AAAA ${host}`);
     if (type === 'MX') {
-      const mx = await withTimeout<dns.MxRecord[]>(dns.resolveMx(host), 5000, `MX ${host}`);
+      const mx = await withTimeout<MxRecord[]>(dns.resolveMx(host), 5000, `MX ${host}`);
       return mx.map((m) => m.exchange);
     }
     if (type === 'TXT') {
@@ -250,7 +251,9 @@ function checkCertOnce(host: string, port = 443, timeoutMs = 7000): Promise<Cert
         }
         const validFrom = cert.valid_from ? new Date(cert.valid_from) : null;
         const validTo   = cert.valid_to   ? new Date(cert.valid_to)   : null;
-        const cn = cert.subject?.CN ?? null;
+        const rawCn = cert.subject?.CN;
+        const cn = Array.isArray(rawCn) ? (rawCn[0] ?? null) : (rawCn ?? null);
+
         finish({ validFrom, validTo, cn, error: null });
       } catch (e: any) {
         finish({ validFrom: null, validTo: null, cn: null, error: e?.message ?? 'parse error' });