Skip to content

Unsupported PKCS#7 Format

URI: https://docs.ankatech.co/errors/unsupported-pkcs7-format
HTTP Status: 422 Unprocessable Entity

When You See This

Your PKCS#7/CMS file is structurally valid and was parsed, but the conversion cannot take it as requested: the request asks for a serialization the file cannot have, the file names more actors than one conversion accepts, or it uses an identifier, a recipient type, an algorithm or a SignedAndEnvelopedData signer form the conversion does not convert.

The number of signers or recipients is not a cause. A SignedData with several signers and an EnvelopedData with several recipients are converted, to the General JSON serialization. See PKCS#7 Conversion.

extensions.errorCode names the condition. Branch on it, not on the detail text.

Response Example

{
  "type": "https://docs.ankatech.co/errors/unsupported-pkcs7-format",
  "title": "Unsupported PKCS#7 Format",
  "status": 422,
  "detail": "serialization COMPACT represents at most one signer and one recipient; the PKCS#7 input carries 3 signer(s) and 0 recipient(s). Use AUTO or JSON.",
  "instance": "/api/v3/migration/convert-pkcs7-to-jose",
  "correlationId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "timestamp": 1768472400,
  "extensions": {
    "errorCode": "INCOMPATIBLE_SERIALIZATION"
  }
}

Error Codes

Code Cause What to change
INCOMPATIBLE_SERIALIZATION serialization is COMPACT and the file carries more than one signer or more than one recipient. The Compact serialization carries at most one of each. Send AUTO (the default) or JSON; both produce the General JSON serialization.
ACTOR_LIMIT_EXCEEDED The file carries more signers and recipients together than one conversion accepts (default 16, ankasecure.crypto.jose.max-actors). Refused before any key is looked up; analyze reports the same code as an ERROR reason. The file cannot be converted in one request.
UNSUPPORTED_SIGNER_IDENTIFIER A signer is identified by SubjectKeyIdentifier rather than by issuer and serial number. The detail names its index. Also returned by analyze. Re-create the file with signers identified by issuer and serial number.
UNSUPPORTED_RECIPIENT_TYPE A recipient is not RSA key transport (KeyTransRecipientInfo) named by issuer and serial number — a key-agreement, KEK or password recipient, or a key-transport recipient identified by SubjectKeyIdentifier. Refused on every endpoint, analysis included. For a SubjectKeyIdentifier recipient on any structure, and for every recipient refusal of a SignedAndEnvelopedData, the detail names the recipient's index: PKCS#7 recipient at index 1 is not a key-transport recipient named by issuer and serial number. Only KeyTransRecipientInfo (RSA) is supported. For any other recipient of an EnvelopedData it names the recipient's index and its RecipientInfo alternative as RFC 5652 §6.2 names it (KeyAgreeRecipientInfo, KEKRecipientInfo, PasswordRecipientInfo; KEMRecipientInfo per RFC 9629; OtherRecipientInfo for any other alternative): PKCS#7 recipient at index 0 is a KeyAgreeRecipientInfo. Only KeyTransRecipientInfo (RSA) is supported. Re-create the file with RSA key-transport recipients named by issuer and serial number.
LEGACY_ALGORITHM_REJECTED A signer uses a SHA-1 or MD5 digest and algorithmPolicy.allowLegacyHash is not true. The detail names its index. Set algorithmPolicy.allowLegacyHash to true if the legacy digest is acceptable.
INCOMPATIBLE_TARGET_FORMAT An explicit targetFormat does not match the parsed structure (JWS↔SignedData, JWE↔EnvelopedData, JWE_JWS_NESTED↔SignedAndEnvelopedData). Send AUTO or the matching value.
SIGNED_AND_ENVELOPED_DIGEST_NOT_ENCRYPTED An outer signer of a SignedAndEnvelopedData carries its encryptedDigest without the second encryption under the content-encryption key that RFC 2315 §11.2 requires. Some producers, OpenSSL among them, write this form. Re-create the file with a producer that writes the RFC 2315 §11.2 form, or as separate SignedData and EnvelopedData.
UNSUPPORTED_SIGNED_AND_ENVELOPED_SIGNER_KEY An outer signer of a SignedAndEnvelopedData does not hold an RSA key; RFC 2315 §11.2 defines the digest encryption for rsaEncryption only. The detail names its index. As above.
SIGNED_AND_ENVELOPED_WITHOUT_SIGNER A SignedAndEnvelopedData carries no outer signer, so it has no signature to convert into a signed JOSE token. Also reported by analyze. Convert only a SignedAndEnvelopedData with at least one signer; content that is only encrypted belongs in an EnvelopedData.
UNSUPPORTED_CONTENT_ENCRYPTION A SignedAndEnvelopedData names a content cipher other than AES-128/192/256-CBC or 3DES (DES-EDE3-CBC) — RC2 and CAST5 among them, which an EnvelopedData does convert — or carries content-encryption parameters the named cipher cannot use. The unsupported cipher is also reported by analyze; unusable parameters are found only once the content-encryption key is recovered. On every structure, EnvelopedData included, RC2/CAST5 parameters outside RFC 2268 §6 / RFC 2984 §2.1 (undefined effective key size, malformed CAST5 parameters) are refused by every parse, analysis too, before any key is looked up. Re-export the file with AES-CBC or 3DES content encryption.
UNKNOWN_CONTENT_TYPE The content type is none of SignedData, EnvelopedData and SignedAndEnvelopedData. Convert only those three structures.

Every refusal on this page is decided before any private key is used, except UNSUPPORTED_CONTENT_ENCRYPTION for unusable parameters, which needs the decrypting recipient's key — RC2/CAST5 parameters outside their RFC excepted, which are refused at the parse. On the streaming endpoint each is returned as a response status, before any body byte, at every input size.

Analyze Before Converting

Use the analyze endpoint to check your file before conversion:

POST /api/v3/migration/analyze-pkcs7
Content-Type: application/json

{
  "pkcs7Data": "<base64-encoded-pkcs7>"
}

The response lists every signer and every recipient, supportStatus — every refusal a conversion raises from the structure alone, with the conversion's own code, in the order the conversion decides them (UNSUPPORTED_CONTENT_ENCRYPTION, SIGNED_AND_ENVELOPED_WITHOUT_SIGNER, UNSUPPORTED_SIGNED_AND_ENVELOPED_SIGNER_KEY, SIGNED_AND_ENVELOPED_DIGEST_NOT_ENCRYPTED, then ACTOR_LIMIT_EXCEEDED, with supported false) — the JOSE form a conversion produces (recommendations.migrationPath) and every key it needs (recommendations.requiredKeys).