Skip to content

Trust Anchor Too Large

URI: https://docs.ankatech.co/errors/trust-anchor-too-large
HTTP Status: 413 Payload Too Large

When you see this

The certificate or keystore you uploaded to the TSA trust-anchor plane is larger than the fixed 1 MiB upload bound. The size is checked before any parsing begins, so an oversized blob is never fed to the ASN.1/DER parser — this is a denial-of-service pre-gate, not a parse result.

Common Causes

  • The uploaded file is not a certificate or keystore at all, but a much larger unrelated file.
  • A keystore carrying far more material than a trust-anchor upload requires.
  • The wrong file was selected in the console's upload control.

Response Example

{
  "type": "https://docs.ankatech.co/errors/trust-anchor-too-large",
  "title": "Payload Too Large",
  "status": 413,
  "detail": "The uploaded trust anchor exceeds the maximum allowed size of 1048576 bytes.",
  "instance": "/api/v3/admin/platform/tsa/trust-anchors",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Check the size of the file you selected — a single X.509 certificate is a few kilobytes and a keystore holding a full chain is well under the bound.
  2. Upload only the CA certificate, or a keystore containing only the trust material you intend to anchor.
  3. Confirm you selected the intended file; the bound is a fixed policy value and is not configurable per request.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.