Skip to content

Invalid Certificate

URI: https://docs.ankatech.co/errors/invalid-certificate
HTTP Status: 422 Unprocessable Entity

When you see this

The file you uploaded to the TSA trust-anchor plane could not be read as an X.509 certificate (PEM or DER) or as a PKCS12/JKS keystore. The parser tries a bare certificate first and falls back to a keystore; this error means both attempts failed. The detail is a single fixed sentence by design — a corrupt file, a wrong keystore password, and unrelated bytes are deliberately indistinguishable, so the endpoint cannot be used to probe certificate content.

Common Causes

  • The file is not certificate or keystore material at all.
  • The PEM armor or DER encoding is truncated or corrupt.
  • The upload is a PKCS12/JKS keystore and the supplied password is wrong or missing.
  • No file part was sent, or the file part is empty.
  • The container could not read the uploaded stream.

Response Example

{
  "type": "https://docs.ankatech.co/errors/invalid-certificate",
  "title": "Invalid Certificate",
  "status": 422,
  "detail": "The uploaded file could not be parsed as a valid X.509 certificate or keystore.",
  "instance": "/api/v3/admin/platform/tsa/trust-anchors/analyze",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Confirm the file multipart part is present and non-empty.
  2. Verify the file really is a PEM/DER X.509 certificate or a PKCS12/JKS keystore, and that it is complete rather than truncated.
  3. If it is a keystore, send the password in the password multipart part and check that it opens the store.
  4. Use POST /api/v3/admin/platform/tsa/trust-anchors/analyze to test the file without committing anything.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.