Skip to content

Certificate Expired

URI: https://docs.ankatech.co/errors/certificate-expired
HTTP Status: 422 Unprocessable Entity

When you see this

A certificate you selected for commit as a TSA trust anchor parsed cleanly but is outside its validity window at commit time — it has expired, or it is not yet valid. The upload is refused in full: no anchor from that submission is persisted, and the response deliberately echoes no subject, issuer, serial, or validity date.

Common Causes

  • The certificate's notAfter has already passed.
  • The certificate's notBefore is still in the future, so the certificate is not yet valid.
  • One certificate in a multi-fingerprint selection is outside its window — every selected anchor is validated, and a single failure refuses the whole commit.
  • The server's clock places the certificate outside a window that looks current elsewhere.

Response Example

{
  "type": "https://docs.ankatech.co/errors/certificate-expired",
  "title": "Certificate Expired",
  "status": 422,
  "detail": "The selected certificate is outside its validity window (expired or not yet valid).",
  "instance": "/api/v3/admin/platform/tsa/trust-anchors",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Run the side-effect-free preview, POST /api/v3/admin/platform/tsa/trust-anchors/analyze, with the same file. It returns each CA-eligible candidate with its notBefore, notAfter and currentlyValid flag, which identifies exactly which candidate is at fault.
  2. Obtain a currently valid CA certificate from the time-stamping authority and upload that instead.
  3. If the certificate is valid where you are checking it, confirm the platform host's clock is correct before retrying.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.