Keystore Private Key Without Certificate Chain

URI: https://docs.ankatech.co/errors/keystore-private-key-without-chain
HTTP Status: 400 Bad Request

When you see this

The keystore holds a private-key entry that carries no certificate chain. The platform reads a private key together with its certificate, so such an entry is refused before the key is decrypted. Nothing is imported.

The type is distinct from Invalid Input, so a caller tells this refusal apart by its type (RFC 9457 §3.1.1), never by parsing detail. The detail names nothing of the file, its aliases or its password.

Which route answers with this type

This type originates in the Core API keystore reader. The published routes are the Admin API routes below, which relay the refusal with the same 400, the same type and the same detail:

The preview refuses the same keystore with the same type and detail.

Response Example

{
  "type": "https://docs.ankatech.co/errors/keystore-private-key-without-chain",
  "title": "Keystore private key without a certificate chain",
  "status": 400,
  "detail": "Keystore refused: a private-key entry carries no certificate chain; store the key with its certificate and export the keystore again",
  "instance": "/api/v3/admin/tenants/00000000-0000-0000-0000-000000000001/keys/import-keystore",
  "timestamp": 1761492000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

1. Store the private key together with its certificate (or its full chain) in the keystore.
2. Export the keystore again and import it.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.