{"type":"doc","content":[{"type":"heading","attrs":{"level":2},"content":[{"text":"About Security Server Proxy Error Messages","type":"text"}]},{"type":"paragraph","content":[{"text":"The first step in the error resolution process is to understand where the error message originated in. Therefore, it is important to know what are the components involved in the message flow:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Service consumer","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Consumer-side Security Server (client proxy)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Provider-side Security Server (server proxy)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Service provider.","type":"text"}]}]}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":50.0},"content":[{"type":"media","attrs":{"width":2488,"id":"75a0ca67-46eb-461c-ad85-d00fb2878667","collection":"contentId-4915550","type":"file","height":944}}]},{"type":"paragraph","content":[{"text":"Error messages may be generated by the Security Servers (2, 3) or the service provider information system (4). Error messages generated by the Security Server have a fixed interface-specific (SOAP / REST) structure. However, SOAP and REST error messages contain the same information regardless of the messaging interface. Error messages generated by the Security Server contain three fields:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","width":1800.0,"localId":"dccfd5b2-56a0-48d1-b306-67fb36917cc6"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Field","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1505.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"type (REST)","type":"text"}]},{"type":"paragraph","content":[{"text":"faultCode (SOAP)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1505.0]},"content":[{"type":"paragraph","content":[{"text":"Error code that tells where the error originated in - client proxy (2) or server proxy (3) - and the type of the error.","type":"text"}]},{"type":"paragraph","content":[{"text":"Errors starting with \"Server.ClientProxy\" originate in the consumer side client proxy (2). In this case, more detailed information can be found in the consumer side Security Server (2) proxy application log (/var/log/xroad/proxy.log).","type":"text"}]},{"type":"paragraph","content":[{"text":"Errors starting with \"Server.ServerProxy\" originate in the provider side server proxy (3). In this case, more detailed information can be found in the provider side Security Server (3) proxy application log (/var/log/xroad/proxy.log).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"message (REST)","type":"text"}]},{"type":"paragraph","content":[{"text":"faultString (SOAP)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1505.0]},"content":[{"type":"paragraph","content":[{"text":"More detailed description of the error.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"detail (REST)","type":"text"}]},{"type":"paragraph","content":[{"text":"faultDetail (SOAP)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1505.0]},"content":[{"type":"paragraph","content":[{"text":"A unique ID that can be used to search additional information from the proxy application log (/var/log/xroad/proxy.log).","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"For example, an error message generated by the client proxy on the consumer side Security Server (2):","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"REST/JSON Error Message","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"javascript"},"content":[{"text":"{\n \"type\":\"Server.ClientProxy.SslAuthenticationFailed\",\n \"message\":\"Client (SUBSYSTEM:PLAYGROUND/COM/1234567-8/TestClient) specifies HTTPS but did not supply TLS certificate\",\n \"detail\":\"2ea02d93-e0b8-4e2b-8c6e-fac20f53a3e3\"\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"REST/XML Error Message","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n Server.ClientProxy.SslAuthenticationFailed\n Client (SUBSYSTEM:PLAYGROUND/COM/1234567-8/TestClient) specifies HTTPS but did not supply TLS certificate\n 2ea02d93-e0b8-4e2b-8c6e-fac20f53a3e3\n","type":"text"}]},{"type":"paragraph","content":[{"text":"SOAP Error Message","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n \n \n Server.ClientProxy.SslAuthenticationFailed\n Client (SUBSYSTEM:PLAYGROUND/COM/1234567-8/TestClient) specifies HTTPS but did not supply TLS certificate\n \n \n b782c3a4-f279-43d1-8684-2af318ec2ca5\n \n \n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"Also, errors may occur in the service provider information system (4). In that case, the service provider (4) is free to return any custom error message as long as it's aligned with the X-Road message protocol. In case an error message is returned and it does not follow the structure presented above, the error was generated by the service provider information system (4).","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Consumer Side Security Server (2)","type":"text"}]},{"type":"paragraph","content":[{"text":"The table below contains the ","type":"text"},{"text":"most common error messages","type":"text","marks":[{"type":"strong"}]},{"text":" originated in the consumer side Security Server (2) and their descriptions.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Please note that this is not an exhaustive list of all the errors generated by the Security Server proxy.","type":"text"}]}]},{"type":"table","attrs":{"layout":"full-width","width":1800.0,"localId":"36861377-4420-452a-bcd0-f36fdc9ca503"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"text":"Error code (type / faultCode)","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Error message (message / faultString)","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ClientProxy.UnknownMember","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"The request contains invalid client or service identifier.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Client 'SUBSYSTEM:instanceIdentifier/memberClass/memberCode/subsystemCode' not found","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"In case the client is not found, the client specified in the request is not registered on the consumer side Security Server (2). More information about registering clients can be found ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#42-adding-a-security-server-client"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Could not find addresses for service provider 'SERVICE:instanceIdentifier/memberClass/memberCode/subsystemCode/serviceCode'","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"In case addresses for service provider are not found, there's an error in the service identifier. Please make sure that the value of the service identifier in the request is correct and corresponds to the information registered on the service provider's Security Server (3).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ClientProxy.NetworkError","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Could not connect to any target host ([https://:5500/])","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"The consumer side Security Server (2) is not able to establish a network connection to the provider side Security Server (3). The problem is usually caused by incorrect firewall configurations.","type":"text"}]},{"type":"paragraph","content":[{"text":"On the consumer side Security Server (2), outgoing traffic to the provider side Security Server's (3) ports 5500 and 5577 must be allowed. On the provider side Security Server (3), incoming traffic to ports 5500 and 5577 from the consumer side Security Server (2) must be allowed.","type":"text"}]},{"type":"paragraph","content":[{"text":"More information about required firewall configurations can be found in the Security Server installation guides for ","type":"text"},{"text":"Ubuntu","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ig-ss_x-road_v6_security_server_installation_guide.md#221-network-diagram"}}]},{"text":" and ","type":"text"},{"text":"RHEL","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ig-ss_x-road_v6_security_server_installation_guide_for_rhel.md#221-network-diagram"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Name or service not known. No address associated with hostname.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"DNS lookup of the provider side Security Server (3) fails, because the server is registered with a wrong public FQDN name. Contact the administrator of the provider side Security Server (3).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ClientProxy.CannotCreateSignature.Signer.TokenNotActive","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Token 'softToken' not active","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"More information.","type":"text","marks":[{"type":"link","attrs":{"href":"https://nordic-institute.atlassian.net/wiki/spaces/XRDKB/pages/4916350"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ClientProxy.ServiceFailed.InternalError","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Cause of the error, for example:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Invalid instance identifier: instanceIdentifier","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"Processing the request failed because of an internal error on the consumer side Security Server (2). Check the proxy (2) application log (/var/log/xroad/proxy.log) for details. In case more detailed logging is required, adjust the proxy (2) ","type":"text"},{"text":"logging levels","type":"text","marks":[{"type":"link","attrs":{"href":"https://nordic-institute.atlassian.net/wiki/spaces/XRDKB/pages/4916392"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ClientProxy.SslAuthenticationFailed","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Security server has no valid authentication certificate","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"The consumer side Security Server (2) does not have a valid authentication certificate. The authentication certificate may not exist, it may be disabled, it may not be registered or it may not have a valid OCSP status. To fix the problem, please try the following actions:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure the authentication certificate is imported into the Security Server (2). ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#323-importing-an-authentication-certificate-from-the-local-file-system"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure the certificate is active. ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#54-activating-and-disabling-the-certificates"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure the certificate is registered. ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#522-registration-states-of-the-authentication-certificate"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the OCSP status of the authentication certificate is not in the 'good' state, then the Security Server (2) cannot use the certificate. The OCSP status can be checked in the Keys & Certificates view of the Security Server (2). ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#53-validity-states-of-certificates"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Verify that the soft token holding the authentication certificate is available and logged in. The token status can be checked in the Keys & Certificates view of the Security Server (2). ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#51-availability-states-of-security-tokens"}}]},{"text":".","type":"text"}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Service provider did not send correct authentication certificate","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"The provider side Security Server (3) does not have a valid authentication certificate. The authentication certificate may not exist, it may be disabled, it may not be registered or it may not have a valid OCSP status. To fix the problem, please try the following actions:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure the authentication certificate is imported into the Security Server (3). ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#323-importing-an-authentication-certificate-from-the-local-file-system"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure the certificate is active. ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#54-activating-and-disabling-the-certificates"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure the certificate is registered. ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#522-registration-states-of-the-authentication-certificate"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the OCSP status of the authentication certificate is not in the 'good' state, then the Security Server (3) cannot use the certificate. The OCSP status can be checked in the Keys & Certificates view of the Security Server (3). ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#53-validity-states-of-certificates"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Verify that the soft token holding the authentication certificate is available and logged in. The token status can be checked in the Keys & Certificates view of the Security Server (3). ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#51-availability-states-of-security-tokens"}}]},{"text":".","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Alternatively, the authentication certificate returned by the provider side Security Server (3) does not match with the authentication certificate that has been registered to that Security Server in the global configuration. This may happen when the provider side Security Server (3) uses an external load balancer that has not been configured to use SSL passthrough.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Client (SUBSYSTEM:instanceIdentifier/memberClass/memberCode/subsystemCode) specifies HTTPS but did not supply TLS certificate ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://nordic-institute.atlassian.net/wiki/spaces/XRDKB/pages/4916273"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Client (SUBSYSTEM:instanceIdentifier/memberClass/memberCode/subsystemCode) specifies HTTPS NO AUTH but client made plaintext connection","type":"text","marks":[{"type":"textColor","attrs":{"color":"#1d1c1d"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"The connection type of the client subsystem used by the service consumer (1) is set to ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#1d1c1d"}}]},{"text":"HTTPS NO AUTH","type":"text","marks":[{"type":"code"}]},{"text":" on the consumer side Security Server (2), but the service consumer (1) tried to establish a connection using ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#1d1c1d"}}]},{"text":"http","type":"text","marks":[{"type":"code"}]},{"text":". The ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#1d1c1d"}}]},{"text":"HTTPS NO AUTH","type":"text","marks":[{"type":"code"}]},{"text":" connection type enforces the use of ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#1d1c1d"}}]},{"text":"https","type":"text","marks":[{"type":"code"}]},{"text":", but the client TLS certificate is not verified by the Security Server (2). In other words, ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#1d1c1d"}}]},{"text":"https","type":"text","marks":[{"type":"code"}]},{"text":" is used without mutual TLS authentication (mTLS).","type":"text","marks":[{"type":"textColor","attrs":{"color":"#1d1c1d"}}]}]},{"type":"paragraph","content":[{"text":"More information","type":"text","marks":[{"type":"textColor","attrs":{"color":"#1d1c1d"}},{"type":"link","attrs":{"href":"https://docs.x-road.global/Manuals/ug-ss_x-road_6_security_server_user_guide.html#9-communication-with-the-client-information-systems"}}]},{"text":".","type":"text","marks":[{"type":"textColor","attrs":{"color":"#1d1c1d"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ClientProxy.IOError","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Could not find any certificates for member 'SUBSYSTEM:instanceIdentifier/memberClass/memberCode/subsystemCode'. Are you sure tokens containing the certifications are logged in?","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"The member owning the subsystem that's used as a client of the request does not have a valid sign certificate on the consumer side Security Server (2). The sign certificate may not exist, it may be disabled or it may not have a valid OCSP status. To fix the problem, please try the following actions:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure the sign certificate is imported into the Security Server (2). ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#312-importing-a-certificate-from-the-local-file-system"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure the certificate is active. ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#54-activating-and-disabling-the-certificates"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the OCSP status of the sign certificate is not in the 'good' state, then the Security Server (2) cannot use the certificate. The OCSP status can be checked in the Keys & Certificates view of the Security Server (2). ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#53-validity-states-of-certificates"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Verify that the token holding the sign certificate is available and logged in. The token status can be checked in the Keys & Certificates view of the Security Server (2). ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#51-availability-states-of-security-tokens"}}]},{"text":".","type":"text"}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ClientProxy.LoggingFailed.TimestamperFailed","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Cannot time-stamp messages: no timestamping services configured","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"Time-stamping of messagelog records failed, because no time-stamping service has been configured on the consumer side Security Server (2). ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#102-managing-the-timestamping-services"}}]},{"text":" on how to configure a time-stamping service.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Cannot time-stamp messages","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"Time-stamping of messagelog records may fail because of multiple reasons:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"the consumer side Security Server (2) is not able to establish network connection to the time-stamping service, e.g., invalid firewall configurations. ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#141-examine-security-server-services-status-information"}}]},{"text":" on how to check the time-stamping service connection status.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"the time-stamping service is not currently available. Check the proxy (2) application log (/var/log/xroad/proxy.log) for details. In case more detailed logging is required, adjust the proxy (2) ","type":"text"},{"text":"logging levels","type":"text","marks":[{"type":"link","attrs":{"href":"https://nordic-institute.atlassian.net/wiki/spaces/XRDKB/pages/4916392"}}]},{"text":".","type":"text"}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ClientProxy.OutdatedGlobalConf","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Global configuration is expired","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"The consumer side Security Server (2) is not able to download global configuration from the Central Server and the local copy of the global configuration has expired. Check the configuration client (2) application log (/var/log/xroad/configuration_client.log) for details. In case more detailed logging is required, adjust the configuration client (2) ","type":"text"},{"text":"logging levels","type":"text","marks":[{"type":"link","attrs":{"href":"https://nordic-institute.atlassian.net/wiki/spaces/XRDKB/pages/4916392"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"You can also try to restart the \"xroad-confclient\" process.","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ systemctl restart xroad-confclient","type":"text"}]},{"type":"paragraph","content":[{"text":"Also, it's is possible that the consumer side Security Server (2) is not able to establish network connection to the Central Server, e.g., invalid firewall configurations. ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#141-examine-security-server-services-status-information"}}]},{"text":" on how to check the global configuration download connection status.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ClientProxy.LoggingFailed.InternalError","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"Writing messages to the message log database fails on the the consumer side Security Server (2).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Ask timed out on [Actor [ akka: // Proxy / user / LogManager # 2110275378 ]] after [40000 ms]. Sender [null] sent message of type \"ee.ria.xroad.common.messagelog.LogMessage\"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"This may happen because the Security Server (2) is over loaded or the hard disk is full. Check the CPU load and free disk space of the server (2). Restarting the server may also help.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[508.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[445.0]},"content":[{"type":"paragraph","content":[{"text":"Futures timed out after [40 seconds]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[679.0]},"content":[{"type":"paragraph","content":[{"text":"This may happen because the Security Server (2) is overloaded. Check the CPU load of the server (2). Restarting the server (2) may also help.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Provider Side Security Server (3)","type":"text"}]},{"type":"paragraph","content":[{"text":"The table below contains the ","type":"text"},{"text":"most common error messages","type":"text","marks":[{"type":"strong"}]},{"text":" originated in the provider side Security Server (3) and their descriptions.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Please note that this is not an exhaustive list of all the errors generated by the Security Server proxy.","type":"text"}]}]},{"type":"table","attrs":{"layout":"full-width","width":1800.0,"localId":"e0dcc8a2-e2f3-4af2-929d-b59f60247005"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"text":"Error code (type / faultCode)","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Error message (message / faultString)","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ServerProxy.AccessDenied","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Request is not allowed: SERVICE:instanceIdentifier/memberClass/memberCode/subsystemCode/serviceCode","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://nordic-institute.atlassian.net/wiki/spaces/XRDKB/pages/4916329"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ServerProxy.ServiceFailed.MissingHeaderField","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Malformed SOAP message: header missing","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"The response message returned by the service provider information system (4) is missing one or more mandatory SOAP headers.","type":"text"}]},{"type":"paragraph","content":[{"text":"SOAP request and response messages must contain some X-Road specific headers. More information about the required headers can be found ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Protocols/pr-mess_x-road_message_protocol.md#22-message-headers"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ServerProxy.ServiceFailed.InvalidSoap","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Cause of the error, for example:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"org.xml.sax.SAXParseException; Premature end of file.","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"The service provider information system (4) returned a malformed SOAP message as a response. Check the proxy (3) application log (/var/log/xroad/proxy.log) for details. In case more detailed logging is required, adjust the proxy (3) ","type":"text"},{"text":"logging levels","type":"text","marks":[{"type":"link","attrs":{"href":"https://nordic-institute.atlassian.net/wiki/spaces/XRDKB/pages/4916392"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ServerProxy.UnknownService","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Unknown service: SERVICE:instanceIdentifier/memberClass/memberCode/subsystemCode/serviceCode","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"The service identified by the service code included in the request does not exist on the service provider's Security Server (3).","type":"text"}]},{"type":"paragraph","content":[{"text":"Please make sure that the value of the service code in the request is correct and corresponds to the information registered on the service provider's Security Server (3).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ServerProxy.ServiceFailed.HttpError","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Cause of the error, for example:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Server responded with error 301: Moved Permanently","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"The service provider side Security Server (3) wasn't able to successfully connect to the service provider information system (4). Check the proxy (3) application log (/var/log/xroad/proxy.log) for details. In case more detailed logging is required, adjust the proxy (3) ","type":"text"},{"text":"logging levels","type":"text","marks":[{"type":"link","attrs":{"href":"https://nordic-institute.atlassian.net/wiki/spaces/XRDKB/pages/4916392"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ServerProxy.ServiceFailed.InternalError","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"Processing the request failed because of an internal error on the provider side Security Server (3).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Signer.UnknownMember: Could not find any certificates for member'SUBSYSTEM:instanceIdentifier/memberClass/memberCode/subsystemCode'. Are you sure tokens containing the certifications are logged in?","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"On the provider side Security Server (3) there's a problem with the sign certificate of the member owning the service that is invoked. The sign certificate may not exist, it may be disabled or it may not have a valid OCSP status. To fix the problem, please try the following actions:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure the sign certificate is imported into the Security Server (3). ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#312-importing-a-certificate-from-the-local-file-system"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make sure the certificate is active. ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#54-activating-and-disabling-the-certificates"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the OCSP status of the sign certificate is not in the 'good' state, then the Security Server (3) cannot use the certificate. The OCSP status can be checked in the Keys & Certificates view of the Security Server (3). ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#53-validity-states-of-certificates"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Verify that the token holding the sign certificate is available. The token status can be checked in the Keys & Certificates view of the Security Server (3). ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#51-availability-states-of-security-tokens"}}]},{"text":".","type":"text"}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Connection pool shut down","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"The provider side Security Server (3) is not able to access its database. Check the proxy (3) application log (/var/log/xroad/proxy.log) and Postgres log (/var/log/postgresql/) for details. In case more detailed logging is required, adjust the proxy (3) ","type":"text"},{"text":"logging levels","type":"text","marks":[{"type":"link","attrs":{"href":"https://nordic-institute.atlassian.net/wiki/spaces/XRDKB/pages/4916392"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ServerProxy.ServiceFailed.CannotCreateSignature","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Failed to get signing info for member HttpError: Connection to Signer (port 5558) timed out","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"There's a problem with signer on the provider side Security Server (3). Check the signer (3) application log (/var/log/xroad/signer.log) for details. In case more detailed logging is required, adjust the signer (3) ","type":"text"},{"text":"logging levels","type":"text","marks":[{"type":"link","attrs":{"href":"https://nordic-institute.atlassian.net/wiki/spaces/XRDKB/pages/4916392"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"You can also try to restart the \"xroad-signer\" process.","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ systemctl restart xroad-signer","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ServerProxy.ServiceFailed.InvalidContentType","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Invalid content type: ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"The service provider information system (4) returned a response message which content type isn’t supported by the provider side Security Server (3). The supported content-types for SOAP services are ","type":"text"},{"text":"text/xml","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"application/xop+xml","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"multipart/related","type":"text","marks":[{"type":"code"}]},{"text":". Instead, there are no restrictions for REST services' content-types.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ServerProxy.CannotCreateSignature.Signer.TokenNotActive","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Token 'softToken' not active","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"More information.","type":"text","marks":[{"type":"link","attrs":{"href":"https://nordic-institute.atlassian.net/wiki/spaces/XRDKB/pages/4916350"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ServerProxy.SslAuthenticationFailed","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Server certificate is not trusted","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"SSL authentication between the service provider side Security Server (3) and the service provider information system (4) failed.","type":"text"}]},{"type":"paragraph","content":[{"text":"The error occurs when the \"Verify TLS certificate\" option is selected in the service configuration, but the service certificate hasn't been uploaded to the provider side Security Server (3). The error can be resolved by unchecking the \"Verify TLS certificate\" option or uploading the service certificate to the provider side Security Server (3).","type":"text"}]},{"type":"paragraph","content":[{"text":"More information can be found ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#66-changing-the-parameters-of-a-service"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Client 'SUBSYSTEM:///' has no IS certificates","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"SSL authentication between the service provider side Security Server (3) and the service provider information system (4) failed.","type":"text"}]},{"type":"paragraph","content":[{"text":"The error occurs when the \"Verify TLS certificate\" option is selected in the service configuration, but the service certificate hasn't been uploaded to the provider side Security Server (3). The error can be resolved by unchecking the \"Verify TLS certificate\" option or uploading the service certificate to the provider side Security Server (3).","type":"text"}]},{"type":"paragraph","content":[{"text":"More information can be found ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.x-road.global/Manuals/ug-ss_x-road_6_security_server_user_guide.html#66-changing-the-parameters-of-a-service"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ServerProxy.LoggingFailed.TimestamperFailed","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Cannot time-stamp messages: no timestamping services configured","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"Time-stamping of messagelog records failed, because no time-stamping service has been configured on the service provider side Security Server (3). ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#102-managing-the-timestamping-services"}}]},{"text":" on how to configure a time-stamping service.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Cannot time-stamp messages","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"Time-stamping of messagelog records may fail because of multiple reasons:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"the service provider side Security Server (3) is not able to establish network connection to the time-stamping service, e.g., invalid firewall configurations. ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#141-examine-security-server-services-status-information"}}]},{"text":" on how to check the time-stamping service connection status.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"the time-stamping service is not currently available. Check the proxy (3) application log (/var/log/xroad/proxy.log) for details. In case more detailed logging is required, adjust the proxy (3) ","type":"text"},{"text":"logging levels","type":"text","marks":[{"type":"link","attrs":{"href":"https://nordic-institute.atlassian.net/wiki/spaces/XRDKB/pages/4916392"}}]},{"text":".","type":"text"}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ServerProxy.OutdatedGlobalConf","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Global configuration is expired","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"The service provider side Security Server (3) is not able to download global configuration from the Central Server and the local copy of the global configuration has expired. Check the configuration client (3) application log (/var/log/xroad/configuration_client.log) for details. In case more detailed logging is required, adjust the configuration client (3) ","type":"text"},{"text":"logging levels","type":"text","marks":[{"type":"link","attrs":{"href":"https://nordic-institute.atlassian.net/wiki/spaces/XRDKB/pages/4916392"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"You can also try to restart the \"xroad-confclient\" process.","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ systemctl restart xroad-confclient","type":"text"}]},{"type":"paragraph","content":[{"text":"Also, it's is possible that the service provider side Security Server (3) is not able to establish network connection to the Central Server, e.g., invalid firewall configurations. ","type":"text"},{"text":"More information","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/nordic-institute/X-Road/blob/develop/doc/Manuals/ug-ss_x-road_6_security_server_user_guide.md#141-examine-security-server-services-status-information"}}]},{"text":" on how to check the global configuration download connection status.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ServerProxy.LoggingFailed.InternalError","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"Writing messages to the message log database fails on the the service provider side Security Server (3). ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Ask timed out on [Actor [ akka: // Proxy / user / LogManager # 2110275378 ]] after [40000 ms]. Sender [null] sent message of type \"ee.ria.xroad.common.messagelog.LogMessage\"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"This may happen because the Security Server (3) is overloaded or the hard disk is full. Check the CPU load and free disk space of the server (3). Restarting the server may also help.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Futures timed out after [40 seconds]","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"This may happen because the Security Server (3) is overloaded. Check the CPU load of the server (3). Restarting the server (3) may also help.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[503.0]},"content":[{"type":"paragraph","content":[{"text":"Server.ServerProxy.IOError","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[455.0]},"content":[{"type":"paragraph","content":[{"text":"Received fatal alert: handshake_failure","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[674.0]},"content":[{"type":"paragraph","content":[{"text":"TLS handshake between the Security Server (3) and the service provider information system (4) failed.","type":"text"}]},{"type":"paragraph","content":[{"text":"This may happen because the Security Server (3) and the service provider information system (4) don’t support the same TLS ciphers and/or TLS protocol versions. ","type":"text"}]},{"type":"paragraph","content":[{"text":"By default, the Security Server supports TLSv1.2 and the supported ciphers are listed ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.x-road.global/Manuals/ug-syspar_x-road_v6_system_parameters.html#Ref_note1"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Supported TLS versions and ciphers can be configured using the ","type":"text"},{"text":"proxy.client-tls-ciphers","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"proxy.client-tls-protocols","type":"text","marks":[{"type":"code"}]},{"text":" properties. More information about the properties can be found ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.x-road.global/Manuals/ug-syspar_x-road_v6_system_parameters.html#32-proxy-parameters-proxy"}}]},{"text":".","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Related articles","type":"text"}]},{"type":"paragraph","content":[{"type":"placeholder","attrs":{"text":"Related articles appear here based on the labels you select. Click to edit the macro and add or change labels."}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"contentbylabel","parameters":{"macroParams":{"showLabels":{"value":"false"},"max":{"value":"5"},"spaces":{"value":"XRDKB"},"showSpace":{"value":"false"},"sort":{"value":"modified"},"type":{"value":"page"},"reverse":{"value":"true"},"labels":{"value":"security-server"},"cql":{"value":"label = \"security-server\" and type = \"page\" and space = \"XRDKB\""}},"macroMetadata":{"macroId":{"value":"6bc4aa5b-34c3-4ae5-92d9-8773cb654418"},"schemaVersion":{"value":"4"},"title":"Filter by label (Content by label)"}},"localId":"114355d5-f262-48a0-b212-0deeb4376212"}},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"details","parameters":{"macroParams":{"hidden":{"value":"true"}},"macroMetadata":{"macroId":{"value":"d681e63a-ba89-4e3b-9184-5591ba8c7f21"},"schemaVersion":{"value":"1"},"title":"Page Properties"}},"localId":"751c9e55-e8a6-46b0-9eda-6e852c318977"},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"table","attrs":{"layout":"default","localId":"0d63150d-4052-4819-b97f-4b790125f537"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[904.0]},"content":[{"type":"paragraph","content":[{"text":"Related issues","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[352.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}],"version":1}

Browser not supported