{"record":{"id":"8fad9bfd004db722","repo":"hashicorp/vault","slug":"message-see-console-for-signed-ca-chain-data","errorCode":null,"errorMessage":"${message}. See console for signed ca_chain data.","messagePattern":"(.+?)\\. See console for signed ca_chain data\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"ui/lib/pki/addon/components/pki-issuer-cross-sign.js","lineNumber":224,"sourceCode":"      );\n      // 5. Fetch issuer imported above by issuer_id, name and save\n      // Recovery: cosmetic issue; can let the user deal with it. Usually\n      // fails because the name is in use.\n      // Pre-fix: list all issuers, check the desired name isn't either\n      // an existing issuer_id or an issuer_name.\n      const crossSignedIssuer = await this.api.secrets.pkiReadIssuer(issuerId, intMount);\n      crossSignedIssuer.issuer_name = newCrossSignedIssuer;\n      await this.api.secrets.pkiWriteIssuer(issuerId, intMount, crossSignedIssuer);\n      // 6. Return the data to our caller.\n      return {\n        intermediateIssuer: existingIssuer,\n        newCrossSignedIssuer: crossSignedIssuer,\n        intermediateMount: intMount,\n      };\n    } catch (e) {\n      console.debug('CA_CHAIN \\n', signedCaChain); // eslint-disable-line\n      const { message } = await this.api.parseError(e);\n      throw new Error(`${message}. See console for signed ca_chain data.`);\n    }\n  }\n\n  @action\n  reset() {\n    this.signedIssuers = [];\n    this.validationErrors = [];\n    this.formData = [];\n  }\n\n  nameValidation(nameInput, existing) {\n    if (existing.any((i) => i.issuer_name === nameInput || i.issuer_id === nameInput))\n      return {\n        errors: [`Issuer reference '${nameInput}' already exists in this mount.`],\n        isValid: false,\n      };\n    return { errors: [], isValid: true };\n  }","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/hashicorp/vault/blob/744b611b5700b3b7f82d76b4d6938a91b9989367/ui/lib/pki/addon/components/pki-issuer-cross-sign.js#L206-L242","documentation":"Catch-all thrown by the PKI cross-sign component (ui/lib/pki/addon/components/pki-issuer-cross-sign.js:224). Any API failure during the multi-step cross-sign flow (generate CSR, sign with parent, import/submit the signed cert, write the issuer) reaches this handler: it logs the already-signed ca_chain to the console via console.debug, parses the API error with api.parseError(), and rethrows with the server message plus a pointer to the console for the signed chain data.","triggerScenarios":"Any pkiGenerateIntermediate, pkiSignIntermediate, pkiIssuer submit/import, or pkiWriteIssuer call inside crossSignIntermediate() fails — e.g. policy denies a step, mount parameter mismatch, TTL constraints rejected by the parent, or an import error for the cross-signed certificate.","commonSituations":"The multi-step flow fails midway so earlier cross-signed issuers already exist; the signed ca_chain is only available in console.debug output, which is easy to miss; partial state leaves issuers cross-signed but unnamed/not fully written.","solutions":["Read the message from api.parseError — it carries the underlying Vault API error for the failed step","Open the browser console, copy the logged CA_CHAIN data before anything else — it is the only copy of the signed certificate chain","Import the recovered chain manually: vault write pki/<mount>/issuer/import/bundle pem_bundle=@chain.pem (or the set-signed/import-csr endpoints appropriate to your flow)","Then re-run the UI flow or complete remaining steps (naming the issuer, pkiWriteIssuer) via CLI"],"exampleFix":"// caller of crossSignIntermediate: preserve partial results\ntry {\n  const result = await this.crossSignIntermediate(mount, name, newName);\n} catch (e) {\n  // message already embeds the API error; the signed ca_chain is in console.debug\n  this.flash.danger(e.message);\n  // recover the chain from the console log and import manually:\n  //   vault write pki/<mount>/issuer/import/bundle pem_bundle=@recovered.pem\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const result = await this.crossSignIntermediate(intMount, intName, newCrossSignedIssuer);\n} catch (e) {\n  // Message embeds the parsed API error. CRITICAL: the signed ca_chain is only in\n  // console.debug ('CA_CHAIN') — capture it and import manually so the work is not lost:\n  //   vault write pki/<intMount>/issuer/import/bundle pem_bundle=@recovered-chain.pem\n  reportError(e.message);\n  preserveConsoleChainForRecovery();\n}","preventionTips":["Open devtools before starting a multi-issuer cross-sign — the signed chain is logged to console.debug only on failure","Verify policies cover every step (generate-csr, sign-intermediate, issuer import/write) on both mounts before starting","Check parent mount TTL/usage constraints first; mid-flow sign failures are the most common trigger","After recovery, complete leftover steps (naming the issuer via pkiWriteIssuer) via CLI before re-running the UI flow"],"tags":["pki","cross-signing","partial-failure","recovery","api-error"],"backgroundTag":null,"analyzedSha":"744b611b5700b3b7f82d76b4d6938a91b9989367","analyzedAt":"2026-08-15T14:40:29.333Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}