Skip to content

TSA Trust Anchor Selection Invalid

URI: https://docs.ankatech.co/errors/tsa-trust-anchor-selection-invalid
HTTP Status: 400 Bad Request

When you see this

The fingerprints selection sent with a TSA trust-anchor upload does not match what the uploaded file actually contains. The commit path never silently picks a candidate for you: when the parse is ambiguous or a requested fingerprint is absent, the whole upload is refused. The detail is fixed and echoes neither the requested fingerprints nor any parsed certificate metadata.

Common Causes

  • A requested fingerprint is not among the file's CA-eligible certificates — typically a stale selection taken from an earlier analysis of a different file.
  • The file parsed but contains no CA-eligible certificate at all (every certificate in it is an end-entity certificate, not a CA).
  • No fingerprints selection was sent while the file yields more than one CA-eligible candidate, so the choice is ambiguous.

Response Example

{
  "type": "https://docs.ankatech.co/errors/tsa-trust-anchor-selection-invalid",
  "title": "Bad Request",
  "status": 400,
  "detail": "One or more selected fingerprints are not among the uploaded file's CA-eligible certificates.",
  "instance": "/api/v3/admin/platform/tsa/trust-anchors",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Call POST /api/v3/admin/platform/tsa/trust-anchors/analyze with the exact file you intend to commit. It returns every CA-eligible candidate with its SHA-256 fingerprint, without persisting anything.
  2. Send fingerprints values copied from that analysis of that same file — do not reuse a selection made against an earlier upload.
  3. If the analysis returns an empty list, the file carries no CA certificate; upload the issuing CA certificate rather than the time-stamping authority's end-entity certificate.
  4. Omitting fingerprints is only valid when the analysis yields exactly one candidate.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.