Troubleshooting

Sectigo Edge reports problems with a precise error code instead of a generic failure. API errors look like this:

{
  "error": {
    "code": "step_up_required",
    "message": "This action requires an MFA-authenticated privileged session issued within the last ten minutes",
    "request_id": "c0f3…"
  }
}

Search this page for the code. When you contact support, include the request_id.

First checks

Check	How
Is issuance paused?	The top bar shows issuance paused. Errors return HTTP 423 with issuance_paused.
Are enough nodes healthy?	Console›Incidents, Quorum capacity, or the Healthy nodes metric on Trust health
Is your MFA fresh?	Privileged actions need MFA from the last ten minutes. Sign out and in again.
What does the node say?	Run sectigo-edge status and sectigo-edge integrations on the node. See CLI reference.

Sign-up and sign-in

Symptom / code	Cause	Fix
registration_email_invalid	The email address is not on the domain you are registering.	Use a work address on that domain.
registration_domain_invalid	The domain is not a registrable enterprise DNS domain.	Enter your organization's registrable domain, for example example.com.
challenge_failed	The bot-protection challenge failed or expired.	Reload the page and submit again.
registration_rate_limited	Too many registration attempts.	Wait, then try again.
verification_email_unavailable	The verification email could not be sent.	Try again in a few minutes.
email_verification_required	You tried domain verification before confirming your email.	Open the link in the verification email first.
domain_challenge_not_found	The DNS TXT record was not found.	Publish the exact record name and value shown, wait for DNS to propagate, then select Verify DNS record.
domain_verification_rate_limited	Too many DNS checks.	Wait before retrying.
registration_expired	The registration is older than its validity window.	Start a new registration.
Sign-in says Your credentials are valid. Complete email and domain verification, then wait for workspace approval.	The workspace is not approved yet (pending_workspace).	Finish verification and wait for approval. See Workspace approval.
invalid_credentials	Wrong email or password.	Retry, or use Forgot password.
login_rate_limited / account_temporarily_locked	Too many failed attempts.	Wait, then try again.
account_not_active	The account has been deactivated.	Ask a tenant administrator.
mfa_code_invalid	The authenticator code is wrong.	Check that your device clock is correct, then use the current code.
mfa_code_replayed	That code has already been used.	Wait for the next code.
mfa_attempts_exceeded	Too many wrong codes.	Sign in again from the start.
password_reset_invalid	The reset link is invalid or expired. Links last 15 minutes.	Request a new link.
password_policy_failed	The password must be 12–128 characters.	Choose a longer password or passphrase.
password_reuse_rejected	You used this password recently.	Choose a different one.
session_expired / session_revoked	The session ended, or was signed out elsewhere.	Sign in again.
tenant_scope_mismatch	Your session is not authorized for this tenant.	Sign in to the right workspace.
step_up_required	The action needs MFA from the last ten minutes.	Sign in again, then retry.
phishing_resistant_step_up_required	The action needs a recent passkey or phishing-resistant enterprise MFA.	Sign in with your passkey or security key.
last_required_passkey	You tried to revoke your last required passkey.	Enrol another passkey first.

See also First login and MFA.

Mesh nodes and enrollment

Symptom / code	Cause	Fix
The installer stops before starting the service	Signature, schema, path, platform, expiry, TLS, trust or permission check failed.	Read the installer message. Nothing was changed on the host. Fix the input and rerun.
enrollment_token_replayed	The enrollment package was already used, or has expired. Packages last at most one hour.	Create a new package. Never copy or edit an old one.
enrollment_scope_mismatch	The package is for a different node name or platform.	Create a package for this exact node and platform.
hardware_node_key_required / node_attestation_required	The tenant requires a hardware-protected key (TPM 2.0 or Windows CNG) with attestation.	Install on a host with TPM 2.0 (Linux) or the Microsoft Platform Crypto Provider (Windows).
"This host is already enrolled; rerun with --upgrade and no bootstrap package"	You ran a fresh install on an enrolled host.	Use upgrade mode. See Upgrades.
node_mtls_binding_mismatch / node_mtls_binding_reused	The node's client certificate does not match its enrollment, or belongs to another node.	Use one client identity per node. Restore the original material, or re-enroll.
node_signature_expired	The node's request time is outside the permitted window.	Fix time synchronization (NTP) on the host.
node_disabled / unknown_node	The node is disabled, or not enrolled in this tenant.	Check Console›Mesh nodes. Re-enroll if required.
Node shows offline	The node has stopped reporting.	Check the service (systemctl status edgepki-node, or the SectigoEdgeMeshNode Windows service) and outbound HTTPS.
customer_quorum_unavailable / customer_node_unavailable	Too few healthy, eligible nodes to approve.	Bring nodes back online, or enrol more. Check the eligible approval nodes in the profile.
Node status: degraded	The OTLP exporter or dependency discovery is failing.	Check the integrations and dependency_discovery fields in sectigo-edge status.
audit_customer_witness_pending during evidence export	Not enough nodes have witnessed the latest checkpoint.	Keep the eligible nodes connected, then retry.

See also Enrollment and Backup & recovery of nodes.

Integrations

Console›Integrations shows the state and the last error code of each integration. On the node, sectigo-edge integrations shows the local view.

Code	Integration	Cause	Fix
pending_node (state)	Node adapters	The node has not acknowledged the current revision.	Check the node is online. It polls outbound, so allow time for one poll.
scm_connectivity_not_verified	Sectigo SCM	Expected: the cloud SCM integration has no live connectivity test.	Confirm SCM by issuing a test certificate. Check the connector's IDs under Console›CAs & signing.
scm_connector_not_active	Sectigo SCM	The integration needs an active SCM CA connector.	Connect and activate the SCM connector first.
adapter_not_installed	Any	The node does not have this adapter enabled locally.	Enable the adapter in the node's config.json and restart.
adapter_reference_invalid	Any	The console's adapter reference does not match the node's configured local/... reference.	Make the two match exactly.
profile_not_mapped	Vault, others	The console profile does not match the node's configured profile ID.	Align the profile IDs.
adapter_reference_required / invalid_adapter_reference	Any	The adapter reference is missing, contains path traversal or looks like a secret.	Use a plain local/<name> reference. Secrets stay on the node.
integration_node_required / integration_node_not_enrolled	Any	No target node, or the target is not enrolled.	Choose at least one enrolled node.
integration_disabled	Any	You tested a disabled integration.	Enable it, then test.
nginx_not_configured, apache_not_configured, java_keystore_not_configured, hashicorp_vault_not_configured, kubernetes_csr_not_configured, spire_not_configured, est_not_configured, adcs_not_configured	That adapter	The node is assigned the integration but its local configuration is missing.	Add the adapter's settings to the node configuration.
nginx_configuration_invalid / apache_configuration_invalid	NGINX / Apache	The expanded server configuration failed validation, or the managed include is not bound.	Fix the web server configuration. Check the include path.
nginx_recovery_pending, apache_recovery_pending, java_keystore_recovery_pending, vault_recovery_pending	Activating adapters	A promotion or rollback was interrupted and could not yet be verified.	The node retries automatically. Check that the service is up and the health URL answers.
nginx_state_invalid, apache_state_invalid, java_keystore_state_invalid, vault_state_invalid, *_active_pointer_invalid, vault_pointer_invalid	Activating adapters	The node's local generation state or active pointer is not what it expects.	Do not edit the managed directory by hand. Check for out-of-band changes, then contact support with the node's status output.
java_keystore_content_invalid	Java PKCS#12	The keystore content does not match its pinned digest.	Check whether something else rewrote the keystore.
vault_unavailable	HashiCorp Vault	Vault is unreachable, or rejected the request. Only this integration is affected.	Check the Vault address, token file, TLS trust and network. The node retries every poll.
vault_awaiting_desired_state / vault_bootstrap_failed	HashiCorp Vault	Waiting for cloud desired state, or the initial import failed.	Assign the integration in the console. Check the bootstrap certificate and key files.
<adapter>_integration_unavailable	Rotation request	The adapter is not healthy and assigned on this node.	Fix the integration until it is healthy.
<adapter>_integration_binding_mismatch	Rotation request	The request's adapter reference or profile differs from the active desired state.	Use the exact reference and profile from the console.
adcs_integration_not_ready	Microsoft ADCS	ADCS desired state is not healthy on the initiating node.	Check the Windows node's ADCS adapter.

Issuance

Code	Cause	Fix
issuance_paused (HTTP 423)	The kill switch is active.	Resume with two people. See Incident response.
customer_quorum_required / dual_approval_required	Not enough distinct node approvals, or one trust domain did not approve.	Check that the policy's quorum can be met by healthy, eligible nodes.
policy_not_configured	The tenant has no active policy.	Activate a first policy version.
platform_policy_not_configured	The Sectigo platform baseline is missing or not valid. Issuance stays closed.	This is on the Sectigo side. Contact support.
ca_not_configured / ca_not_active	No active production CA connector.	Connect and activate a CA under Console›CAs & signing.
remote_signer_not_configured / signer_transport_not_configured	The protected signing service is not configured for this deployment.	Contact support.
remote_signer_failed	The protected signer rejected the operation.	Retry once. If the signer could not tell whether the CA acted, it refuses retries of that exact request (idempotency_outcome_uncertain) until the outcome is reconciled. Do not resubmit in a loop. Contact support with the request_id.
workload_profile_denied / workload_san_denied / workload_scope_denied	The workload's identity token does not allow this profile, DNS name or operation.	Fix the workload's token claims, or the profile's allowed identities and DNS names.
workload_mtls_required / workload_token_not_sender_constrained	Cloud fallback needs a valid client certificate that is bound to the token.	Present the workload's client certificate. Check that the token's cnf thumbprint matches it.
issuance_risk_evidence_missing	The request was created before guardrail evaluation existed.	Resubmit the request.
Request denied with a guardrail signal	An enforcing issuance guardrail blocked it.	Review the finding under Console›Incidents. Adjust the guardrail through a policy change if it is legitimate.
rotation_policy_required	The adapter needs an explicit signed dual-slot rotation policy.	Add a rotation block to the profile.
automatic_promotion_forbidden	The workload asked to auto-promote under a manual profile.	Promote from Console›Rotation, or change the profile's promotion setting.
promotion_health_url_forbidden / promotion_health_url_invalid	The health URL host is not in the SANs, or the URL is not plain HTTPS.	Use https://<covered-host>/health, with no credentials and no fragment.
standby_not_staged / standby_not_healthy	There is no standby, or it is not healthy.	Stage the standby again.
promotion_adapter_required	Console promotion needs an activating adapter.	Use NGINX, Apache, Java PKCS#12 or Vault, or promote on the node.

Revocation

Symptom / code	Cause	Fix
CRL URL returns 503	The latest CRL is within five minutes of nextUpdate, or has expired (crl_expired).	Select Publish new CRL, then check that the CA connector is healthy.
OCSP returns tryLater	The certificate is known, but no fresh verified response is published yet.	Wait for the retry, or select Refresh under Console›Revocation.
OCSP returns malformedRequest	The client sent a nonce, a signature, several CertIDs or extensions.	Disable OCSP nonces for this responder.
OCSP returns unauthorized	The certificate or issuer is unknown to this responder.	Check that the client is using the right issuer and responder URL.
Status stays pending after revoking	Publication failed and is being retried (1 minute, then every 5 minutes).	Normal during short outages. If it persists, check the CA under Console›CAs & signing.
Status external	Microsoft ADCS: the local CA has not produced an accepted artifact yet.	Check the assigned Windows node and the Online Responder.
certificate_not_revocable	The certificate is not in the issued state.	It may already be revoked. Refresh the list.
crl_context_required	The CA has not issued anything yet.	Issue one certificate first.

Policies and migrations

Code	Fix
policy_impact_changed	The original proposer selects Refresh estate impact.
policy_impact_blocked	Resolve the missing, stale, unassigned, ambiguous, unverified or incompatible endpoints.
policy_separation_of_duties / migration_separation_of_duties	Have a different person approve.
migration_*_changed	Something drifted after planning. Create a new plan.
migration_outside_window	Start inside the maintenance window.
migration_recovery_restage_required	Re-stage the exact target on the assigned node.

More detail: Policy changes & approvals and Cryptographic migrations.

Break-glass and incidents

Code	Cause	Fix
resume_requires_dual_approval	You tried to unpause through the kill switch.	Use Request guarded resume, then have a second person approve.
break_glass_self_approval	The requester tried to approve.	A different person must approve.
break_glass_expired	More than ten minutes have passed since the request.	Create a new request.
break_glass_generation_stale	Issuance was paused again after the request.	Create a new request for the current pause.
break_glass_already_pending	A request is already waiting.	Approve or let that request expire.
break_glass_reason_invalid	The reason must be 16–1,000 characters.	Write a fuller reason.
confirmation_required	The confirmation text is not exact.	Type the phrase exactly, for example PAUSE ISSUANCE.

Trust events and audit

Code / symptom	Fix
HTTP 410 / trust_event_cursor_expired	The cursor is older than the retained window. Resynchronize deliberately, and do not reset the cursor automatically.
trust_event_topic_invalid	Use only the published topics. See Monitoring & alerts.
Audit chain could not be verified	Refresh. If the label persists, export a proof and treat it as a potential incident.
otlp_audit_* in node health	See Monitoring & alerts.