HSMAlreadyLoaded

Duplicate HSM registration at startup

HSMNotFound

Referenced HSM ID not configured

ErrorEmptyToken / ErrorEmptyHSM

Missing HSM token/label in config

UnknownToken

Configured token not present on the HSM

ConfigErrorInvalidTSASigner

Signer config is invalid

ConfigErrorTSTProfile

ConfigErrorTSTInfoProfile

ConfigErrorCMSSignerInfoProfile

Profile config is malformed

ConfigErrorMissingMandatoryRule

Required rule missing from profile

ConfigErrorDuplicatedRule

ConfigErrorBadRulePosition

Rule ordering/duplication error

ConfigErrorInvalidPolicyID

Policy OID malformed in config

UnsupportedCryptoSignerTypeError

Key algorithm not supported

NoTSAIssuersError

No usable TSA issuers configured

ErrorParsingClientURL

Upstream URL (e.g. clock service) malformed in config

ErrorParsingAllowedMaxClockError 

ErrorParsingPollInterval

ErrorParsingAccuracy

Duration/accuracy fields malformed in config

AllowedMaxErrorExceedsAccuracy

AllowedMaxClockError > Accuracy — self-inconsistent policy

ErrorPVKNotMatchCertPBK

Private key does not match the public key in the TSA cert

SignerPublicKeyValidationError

TSA signer certificate failed validation

ErrorCertificateIsCA

TSA cert has basicConstraints CA:TRUE — wrong cert

ErrorMissingTimeStampKeyUsageExt

TSA cert missing id-kp-timeStamping EKU

ErrorExtendedKeyUsageExtNotCritical

EKU extension not marked critical (RFC 3161 violation)

ErrorMoreThanOneExtendedKeyUsageExt

Duplicate EKU extension

ExpiredPrivateKey

TSA signing private key has already expired

SwaggerServerError

REST server failed to start

InvalidTSRequest

Client sent a malformed RFC 3161 request

TSRequestDecodeError

Request body could not be ASN.1-decoded

BadDataFormatTSError

Request violates format constraints

UnsupportedAlgorithmTSError

Client asked for a hash algorithm this TSA does not support

MessageImprintHashLengthMisMatchTSError

Hash length inconsistent with declared algorithm

UnacceptedPolicyTSError

Requested policy OID not accepted by this TSA

UnacceptedExtensionTSError

Request contains an extension the TSA does not accept

MaximumNonceLengthExceededError

Client nonce too long

FoundEmptyAlgorithm

Algorithm identifier missing from the request

UnknownTSAIDPathVarError

Client called /{tsaID}/tsr with an unknown TSA ID

UnknownTSAIssuerError

Configured issuer for that TSA ID has vanished at runtime

ProcessTSRequestFailed

Signing pipeline failed for this request

GetTSTInfoError

Could not build the TSTInfo structure

TSInternalServerError

Generic internal failure sentinel

TSSerialNumberGenerationError

Could not allocate a new TS serial number

TSANameGenerationError

Could not build the TSA name

TSResponseDecodeError 

TSResponseMarshallError

TSErrorResponseMarshallError 

TSTInfoMarshallError

ASN.1 encode/decode failure on the response side

EncapsulatedContentInfoCreationError

SignedDataCreationError

AddSignerInfoError

ContentInfoCreationError

CMS assembly failure

QCStatementsMarshallError

Could not encode qcStatements extension

AddCertificateError / EncodeCMSError

Cert chain / CMS assembly failure

SystemFailureTSError

Explicit systemFailure PKIStatus returned to the client

TimeNotAvailableTSError

Explicit timeNotAvailable PKIStatus — clock is not usable

UnknownTSTInfoProfile

Referenced profile disappeared at runtime

InvalidTstInfoProfileError

InvalidCmsSignerInfoProfileError

UnknownRuleError

InvalidAllowedExtensionError

RuleNotFoundError

Runtime profile / rule lookup failure

ErrorSetSeed

ErrorDecrypt

Crypto helper failure

ErrorUnmarshalQCStatementsExtension

ErrorUnmarshalQCStatementsExtensionHasExtraBytes

ErrorNoQCStatementFoundinQCStatementsExtension

Malformed qcStatements in TSA cert

ErrorUnmarshalPrivateKeyUsagePeriod

Could not read the privateKeyUsagePeriod extension

BadClock

Actual clock error exceeded AllowedMaxClockError — TSA refuses to sign

ErrorClockServiceClientCreate

Could not construct the clock-service client

ErrorClockServiceClientResponse

Clock service call failed

ErrorClockServiceResponseProcessing

Clock service response could not be parsed

HealthCheckClockStatusServiceTestFailed

/healthcheck clock probe failed for an issuer

HealthCheckPVKUsagePeriodTestFailed

Signer private-key usage period no longer valid

HealthCheckRetrieveTSAIssuersFailed

Could not list configured TSA issuers

HealthCheckRetrieveTSAIssuerFailed

Could not read a specific TSA issuer at health-check

HealthCheckRetrievedTSASignerFailed

Could not retrieve the signer for an issuer

HealthCheckRetrieveClockServiceFailed

Clock-service dependency missing at health-check

HealthCheckSignatureTestFailed

Test-signature at health-check did not verify

GetTSAHealthStatusFailed

Generic health aggregation failure

ErrorRetrievingNTPData

Could not read state from the local NTP daemon

InvalidNTPDaemonConfig

Configuration for the NTP daemon socket / mode is wrong

ProcessClockStatusRequestError

Clock-status request handler failed

CSInternalServerError

Generic internal failure

SwaggerServerError

REST server failed to start