--- title: Certificate Error Handling description: "Specific errors can arise from use of X.509 certificates: these should be recognized and appropriately dealt with." pubDate: 2026-08-17T09:53:44.266Z antora: editUrl: https://github.com/couchbase/docs-server/edit/release/7.6/modules/manage/pages/manage-security/handle-certificate-errors.adoc xref: xref:7.6@server:manage:manage-security/handle-certificate-errors.adoc[] --- [Consult the llms.txt file for a full list of contents](/llms.txt) [View original HTML](/server/7.6/manage/manage-security/handle-certificate-errors.html) # Certificate Error Handling > Specific errors can arise from use of X.509 certificates: these should be recognized and appropriately dealt with. ## [](#cluster-certificate-errors)Root Certificate Errors The following error messages may be encountered when configuring a CA certificate. For examples of using the `openssl` command to generate and inspect certificates, see [Configure Server Certificates](configure-server-certificates.md). | Couchbase Error Message | Description | Suggested User Action | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | CA certificate for this chain is not found in the list of trusted CA's | The CA certificate used to sign the node certificate is not in the cluster's trust store. | Copy the CA into the inbox/CA directory, then load all trusted CAs. | | Couldn't load CA certificate from /inbox/CA. The file does not exist. | The CA certificate was not copied into the inbox/CA directory, before the attempt to load it was made. | Copy the CA certificate into the inbox/CA directory, then load the CA certificate. | | Certificate should not be empty | The request body of the certificate is empty. | Inspect the certificate file using the openssl command, and verify whether it is empty or not. | | Certificate is not valid at this time | The certificate either has expired, or is not yet valid. | Inspect the certificate file using the openssl command, and verify whether the certificate's validity-dates (Not Before, and Not After) are currently valid, in correspondence with server-clock time. | | Malformed certificate | The certificate contains incorrect content. | Check the validity of the certificate, using openssl, and if necessary, create a new certificate. | | Only one certificate per request is allowed | The file inappropriately contains more than one key or certificate. | Inspect the certificate, and recreate if necessary. | | Invalid certificate type: \~s | Appears when a header other than BEGIN CERTIFICATE has been found. | Inspect the certificate, and verify its validity. Recreate the certificate if necessary | ## [](#node-certificate-errors)Node Certificate Errors The following error messages may be encountered when configuring and deploying the node certificate: | Couchbase Error Message | Description | Suggested User Action | | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Unable to read private key file /inbox/pkey.key. The file does not exist.\` | The private key is not in the inbox directory. | Ensure that the private key for the node certificate has been copied to the inbox folder of the current node. | | Unable to read private key file /inbox/pkey.key. Missing permission for reading the file, or for searching one of the parent directories.\` | The private key is in the inbox directory, but is not readable by user couchbase. | Ensure that the key is readable by user couchbase. | | Incorrectly configured certificate chain | Denotes an invalid certificate in the chain file. | The chain file should contain a sequence of PEM (base64) encoded X.509 certificates, starting from the node certificate, and including all intermediate certificates that exist, in the order of signing. | | Invalid private key type | The private key has an unsupported header. | Make sure that a valid private key file has been created and copied to the inbox of the current node. | | Provided certificate doesn't match provided private key | The certificate does not recognize the message signed with a private key. | Be sure that the mutually corresponding private key and chain file are being used. | | Provided private key contains incorrect number of entries | The private key inappropriately contains more than one entry. | The private key file should contain only a single entry. | | Malformed or unsupported private key format | The private key cannot be used, due to an inappropriate format. | Inspect the private key, verify whether it is valid; and recreate if necessary. | | File does not exist | The file is missing, does not exist. | Add the missing file. | | Missing permission for reading the file, or for searching one of the parent directories | Current permissions do not permit the reading of the file or the searching of its parent directories. | Change the permissions to permit reading and searching. | | Cannot validate certificate for __ because it doesn't contain any IP SANs | The node certificate does not contain the required IP-address _Subject Alternative Name_. | Recreate the node certificate, specifying the appropriate Subject Alternative Name. See [Configure Server Certificates](configure-server-certificates.md). | | Certificate is valid for __, not | The node certificate contains an incorrect IP-address _Subject Alternative Name_. | Recreate the node certificate, specifying the the correct IP-address Subject Alternative Name. See [Configure Server Certificates](configure-server-certificates.md). |