Troubleshooting

The following provides troubleshooting tips to help you get back on track and includes solutions or workarounds for common errors.

Debug Logging

To troubleshoot unexpected behavior in SignServer, enable more detailed (debug) logging by running the following command in the JBoss CLI:

1. Start JBoss CLI:

   APPSRV_HOME/bin/jboss-cli.sh -c

2. Run the following commands to enable DEBUG logging:

   /subsystem=logging/logger=org.ejbca:write-attribute(name=level, value=DEBUG)

   /subsystem=logging/logger=org.cesecore:write-attribute(name=level, value=DEBUG)

   /subsystem=logging/logger=org.signserver:write-attribute(name=level, value=DEBUG)

General Issues

Transaction rolled back error

A transaction timeout can occur for requests that are taking longer time to finish than what is configured for database transactions in the application server.

Example of errors displayed in the log:

Possible reasons include large file uploads and/or downloads, and/or slow network connections, slow HSM connection or HSM, or that contacting external servers takes a long time (CRL/OCSP fetching or time-stamping etc).

Solutions

• Since database transactions are not required if the worker is not configured to access the database, disabling the key usage counter, and not using any archivers will resolve this issue. For more information, see Limiting the number of signatures and Archiving.
• Alternatively, if the key usage counter or an Archiver must be used, reconfigure the application server with a higher value for the transaction timeout. For more information, see Limiting the number of signatures and Archiving.

CKR_PIN_INCORRECT (Luna HSM)

When attempting to log into a Luna HSM, the HSM may require a PIN code from an external PIN pad. If you subsequently try to log in via an application, you might encounter a misleading exception.

A workaround we've seen could be to set ProtectedAuthenticationPathFlagStatus = 1 in the config file of the HSM

SQLFeatureNotSupportedException with PostgreSQL

When running SignServer with certain versions of PostgreSQL, an SQLFeatureNotSupportedException can occur on any database insert. By disabling the L2 and query cache you can forgo this issue. See Deploy-time Configuration.

P11NG / JackNJI11

UnsatisfiedLinkError

There can be a conflict between the JNA implementation in SignServer and the one installed in the system. This can be seen as errors similar to the following:

• java.lang.UnsatisfiedLinkError: com.sun.jna.Native.malloc(J)J
• java.lang.UnsatisfiedLinkError: Can't obtain static newInstance method for class com.sun.jna.Structure

The solution is to remove JNA from the system (i.e. apt-get remove libjna-java) or to run Java with:

USER_NOT_LOGGED_IN Error

If a USER_NOT_LOGGED_IN error is encountered while using the Utimaco HSM, the solution is to enable the KeepAlive setting in the Utimaco configuration file cs_pkcs11_R2.cfg:

SunPKCS11 / PKCS11CryptoToken and Java 17

The PKCS11CryptoToken does not work on Java 17 unless the Java process that runs the application server is passed the JAVA_OPTS parameter  "--add-exports=jdk.crypto.cryptoki/sun.security.pkcs11.wrapper=ALL-UNNAMED".

When using the PKCS11CryptoToken an error similar to the following may be logged:

SunPKCS11 / PKCS11CryptoToken and certain Java 17 versions

Certain Java 17 versions/builds attempt to call C_GetInfo before the call C_Initialize, resulting in many HSM drivers responding with CKR_CRYPTOKI_NOT_INITIALIZED.The issue has been observed with OpenJDK 17 version Red_Hat-17.0.6.0.10-1.fc36 and switching to a different Java version/build is the only known solution.

SignClient

Cannot Produce CertificateVerify Signature

When using SignClient using a PKCS 11 token (e.g. a smart-card reader) for authenticating in some cases (e.g. both server and client running on Java 11) a cipher-suit-related error can occur:

As a workaround, SignClient can be forced to fall back to using TLS version 1.2 (as shown in the commented-out sample in script bin/signclient, a similar example is also present in the Windows batch file bin/signclient.cmd)