hashicorp/vault · error · Error

${message}. See console for signed ca_chain data.

Error message

${message}. See console for signed ca_chain data.

What it means

Catch-all thrown by the PKI cross-sign component (ui/lib/pki/addon/components/pki-issuer-cross-sign.js:224). Any API failure during the multi-step cross-sign flow (generate CSR, sign with parent, import/submit the signed cert, write the issuer) reaches this handler: it logs the already-signed ca_chain to the console via console.debug, parses the API error with api.parseError(), and rethrows with the server message plus a pointer to the console for the signed chain data.

Source

Thrown at ui/lib/pki/addon/components/pki-issuer-cross-sign.js:224

      );
      // 5. Fetch issuer imported above by issuer_id, name and save
      // Recovery: cosmetic issue; can let the user deal with it. Usually
      // fails because the name is in use.
      // Pre-fix: list all issuers, check the desired name isn't either
      // an existing issuer_id or an issuer_name.
      const crossSignedIssuer = await this.api.secrets.pkiReadIssuer(issuerId, intMount);
      crossSignedIssuer.issuer_name = newCrossSignedIssuer;
      await this.api.secrets.pkiWriteIssuer(issuerId, intMount, crossSignedIssuer);
      // 6. Return the data to our caller.
      return {
        intermediateIssuer: existingIssuer,
        newCrossSignedIssuer: crossSignedIssuer,
        intermediateMount: intMount,
      };
    } catch (e) {
      console.debug('CA_CHAIN \n', signedCaChain); // eslint-disable-line
      const { message } = await this.api.parseError(e);
      throw new Error(`${message}. See console for signed ca_chain data.`);
    }
  }

  @action
  reset() {
    this.signedIssuers = [];
    this.validationErrors = [];
    this.formData = [];
  }

  nameValidation(nameInput, existing) {
    if (existing.any((i) => i.issuer_name === nameInput || i.issuer_id === nameInput))
      return {
        errors: [`Issuer reference '${nameInput}' already exists in this mount.`],
        isValid: false,
      };
    return { errors: [], isValid: true };
  }

View on GitHub (pinned to 744b611b57)

Solutions

1. Read the message from api.parseError — it carries the underlying Vault API error for the failed step
2. Open the browser console, copy the logged CA_CHAIN data before anything else — it is the only copy of the signed certificate chain
3. Import the recovered chain manually: vault write pki/<mount>/issuer/import/bundle pem_bundle=@chain.pem (or the set-signed/import-csr endpoints appropriate to your flow)
4. Then re-run the UI flow or complete remaining steps (naming the issuer, pkiWriteIssuer) via CLI

Example fix

// caller of crossSignIntermediate: preserve partial results
try {
  const result = await this.crossSignIntermediate(mount, name, newName);
} catch (e) {
  // message already embeds the API error; the signed ca_chain is in console.debug
  this.flash.danger(e.message);
  // recover the chain from the console log and import manually:
  //   vault write pki/<mount>/issuer/import/bundle pem_bundle=@recovered.pem
}

try {
  const result = await this.crossSignIntermediate(intMount, intName, newCrossSignedIssuer);
} catch (e) {
  // Message embeds the parsed API error. CRITICAL: the signed ca_chain is only in
  // console.debug ('CA_CHAIN') — capture it and import manually so the work is not lost:
  //   vault write pki/<intMount>/issuer/import/bundle pem_bundle=@recovered-chain.pem
  reportError(e.message);
  preserveConsoleChainForRecovery();
}

When it happens

Trigger: Any pkiGenerateIntermediate, pkiSignIntermediate, pkiIssuer submit/import, or pkiWriteIssuer call inside crossSignIntermediate() fails — e.g. policy denies a step, mount parameter mismatch, TTL constraints rejected by the parent, or an import error for the cross-signed certificate.

Common situations: The multi-step flow fails midway so earlier cross-signed issuers already exist; the signed ca_chain is only available in console.debug output, which is easy to miss; partial state leaves issuers cross-signed but unnamed/not fully written.

Related errors

• Cross-signing a root issuer with itself must be performed ma
• Certificate must be manually cross-signed using the CLI.

AI-assisted analysis of hashicorp/vault@744b611b57 (2026-08-15). Data as JSON: /api/errors/8fad9bfd004db722. Report an issue: GitHub.