Find the cause of common problems by symptom, and collect the diagnostics that Encryption Consulting support needs.
| Source | How to get it |
|---|---|
| Support package | Profile > Maintenance > Support Packages: create a package, then download it. Requires the System Admin role. |
| System logs | Logs page: filter by date and time zone, export to CSV or download the system logs. Right-click an entry and select View Details. |
| Audit Trail | Reports > Audit Trail, filtered by date, application and category. |
| Windows KSP | Set EC_SSL_VERBOSE=1, open a new command prompt, and repeat the signing command to see debugging output. Set it back to 0 afterward. To see more detailed logs, check the rolling-ecksp.log in “C:\ProgramData\Encryption Consulting\SigningKSP” directory. The config for this log file can be updated from the ECKSP-LogConfig.xml present in the same directory. |
| PKCS#11 Wrapper | The log configuration file named in [logconfig_file] (EC_PKCS11_CLIENT-LogConfig.xml, included in the wrapper download) controls the wrapper log. |
| Installer | Select Open Logs in the installation wizard. |
When you contact support, include the product version from the profile menu, the client tool and operating system, the exact command, the full error text, and the time of the failure with its time zone. Also attach the support package zip for easier debugging.
| Symptom | Likely cause | Fix |
|---|---|---|
| The portal doesn’t load | Apache service is stopped, or DNS points elsewhere | Check the services and the Apache Monitor on the server, and check the DNS name. |
| The browser shows a certificate warning | The portal still uses the self-signed certificate, or the chain is incomplete, or old cert files are cached | Import a certificate from your PKI with its full chain in the SSL/TLS Management section or restart the Apache monitor if you have already uploaded new certs. |
| Azure AD sign-in fails | Redirect URI, client secret, or consent problem | See Troubleshooting sign-in. |
| You are signed out unexpectedly | Only one session per account is allowed; signing in elsewhere revokes older sessions | Use separate accounts for people and automation. |
| HSM Health Check shows Inactive | The server can’t reach the HSM, or the HSM client is not working | Check the HSM with the vendor tools, for example enquiry for nShield or vtl verify for Luna. The status can take up to 10 minutes to update. |
| The page shows an error right after connecting a plugin | The server restarts after a plugin connects | Wait a few seconds and refresh the page. |
| Emails or MFA codes don’t arrive | No active SMTP configuration, or no active template for that email type | Activate an SMTP configuration in Email > Config and an active template for the event. Check spam folders. |
| A certificate is missing from the team mapping list | The certificate has no environment | Right-click the certificate in Keys and Certificates and select Edit Environment. |
| An environment can’t be selected when creating a certificate | The environment is inactive | Activate it in System Setup > Environment. |
| The SSL/TLS certificate can’t be renewed | Only the active self-signed certificate provided with CodeSign Secure can be renewed. Certificates issued through a CSR and imported can’t be renewed. | For certificates from your PKI, generate a new CSR and import the new certificate. |
| A user can’t be deleted | A replacement user is required | Choose a replacement user to take over the deleted user’s resources. |
| A new user can’t use a feature | The user’s roles have no permissions for it | Enable the permission for the role in Roles and Permissions. |
| Symptom | Likely cause | Fix |
|---|---|---|
| A signing job fails after about 100 seconds | The request needed approval and nobody approved it in time | Approve within 100 seconds, or use a No Approval environment for automation. |
| The approver sees Requires MFA instead of Approve and Deny | The environment needs MFA | Select Requires MFA, enter the emailed code, then approve. |
| The approver doesn’t see the request | The approver isn’t eligible, or the list hasn’t refreshed | Check the approver is the certificate owner or a quorum member with the System Admin or Project Manager role, then select Refresh. |
| Hash validation failed | The artifact doesn’t match the trusted rebuild | Check the signing project’s repository and branch, and see Hash Validation. |
| Symptom | Likely cause | Fix |
|---|---|---|
| SignTool reports that the provider can’t be found or loaded | The KSP isn’t installed, or the name after /csp doesn’t match | Use exactly "Encryption Consulting Key Storage Provider". Run certutil -csplist to check it is registered. |
| “SignTool Error: No certificates were found that met all the given criteria.” | The certificate file doesn’t match the key, or a path or name is wrong | Download the certificate again from Keys and Certificates and check the /f path and /kc key name. |
| “SignerSign() failed” with 0x80090016 (NTE_BAD_KEYSET) | The KSP can’t use the key | Check the /kc name, that the certificate is active and not expired, and that the user is in a team mapped to it. |
| “SignerSign() failed” with 0x8007000B when signing AppX or MSIX | The package Publisher doesn’t match the certificate subject | Set the Publisher in the app manifest to the certificate’s subject. See AppX & MSIX. |
| TLS or authentication errors in the verbose output | EC_Client_Auth path or EC_Client_Pass password is wrong, or the authentication certificate expired | Correct the variables, check the Valid Till date, then open a new command prompt or restart the build agent. |
| Authentication fails although EC_Client_Auth and EC_Client_Pass are correct | The ectoken or an installer setting in the registry is wrong, or the token has expired | Check the values in Computer\HKEY_CURRENT_USER\Software\Encryption Consulting\SigningKSP in Registry Editor, set a new ectoken if needed, then open a new command prompt. |
| Timestamp errors | The TSA can’t be reached | See Timestamping. |
| Symptom | Likely cause | Fix |
|---|---|---|
| The tool can’t load or initialize the PKCS#11 provider | EC_INI_FILE_PATH isn’t set in this shell, or library in pkcs11properties.cfg points to the wrong file | Export the variable in the same shell and check the library path for your OS. |
| jarsigner: “Certificate chain not found for: <alias>” | The alias doesn’t match the key label | Use the key label of your signing certificate as the alias. |
| The wrong key is used, or a key isn’t found after a certificate change | The key cache or automatic label detection picked another key | Set EC_PKCS11_KEY_LABEL or [key_filter], or set EC_PKCS11_DISABLE_CACHE=1 to test without the cache. See Key label and caching. |
| Authentication errors | Wrong PFX path or password, or wrong username or passcode in the INI file | Check each INI section against the reference. |
| Symptom | Likely cause | Fix |
|---|---|---|
| codesign reports errSecInternalComponent | codesign can’t access the signing identity, which is common in CI sessions | Recheck the EC KSP for Mac setup steps and unlock the keychain in CI sessions. See Apple Signing. |
| Kubernetes rejects an image | The admission webhook blocks unsigned images | This is expected. Sign the image first. See Container Signing. |