Transaction rolled back error

A transaction timeout can occur for requests that are taking longer time to finish than what is configured for database transactions in the application server.

Example of errors displayed in the log:

Possible reasons include, large file uploads and/or downloads, and/or slow network connections, slow HSM connection or HSM, or that contacting external servers takes long time (CRL/OCSP fetching or time-stamping etc).

AdminGUI login using smartcard fails on 64-bit (x86_64) version of Windows

The 64-bit version of Oracle Java does not support PKCS#11. On Windows, use a 32-bit version of Java and the PKCS#11 shared library.

AdminGUI login using smartcard fails if path to DLL contains parenthesis

On versions prior to JDK 7u80 and 8 b91, the Java bug JDK-7196009 will cause issues with configuration paths containing parenthesis, for example: c:\program files (x86)\middleware\pkcs11.dll.

As a workaround, make sure to install the middle-ware (PKCS#11/smartcard library) to a path not containing parenthesis.

IPv6 dualstack can give permission denied when trying to connect from AdminGUI

Connecting to SignServer over web services using the AdminGUI on Windows where both IPv4 and IPv6 is available, can give "permission denied".

As a workaround, edit the signserver-gui.cmd and add the following to the command:

AdminGUI login using smartcard fails with some cards

The card prompts for the PIN but then does not ask for which certificate to login with. Instead, the following error message is shown: Received fatal alert: bad_certificate. The error message indicates that the server did not accept the provided certificate (that is the issuer was not in the server's truststore). However, for certain types of smartcards, the issue is caused by inability to read certificate from the card.

The following workaround is proposed:

1. Start the GUI without the card inserted.

2. Press Connect (without the card inserted).

3. Ignore the error message slotListIndex is 0 but token has 0 slots.

4. Insert the card and press Connect again.

5. This time, after the PIN prompt you are asked for which certificate to login with.

UnsatisfiedLinkError

There can be a conflict between the JNA implementation in SignServer and the one installed in the system. This can be seen as errors similar to the following:

• java.lang.UnsatisfiedLinkError: com.sun.jna.Native.malloc(J)J

• java.lang.UnsatisfiedLinkError: Can't obtain static newInstance method for class com.sun.jna.Structure

Solution is to remove JNA from the system (i.e. apt-get remove libjna-java) or to run Java with:

USER_NOT_LOGGED_IN Error

If a USER_NOT_LOGGED_IN error is encountered while using the Utimaco HSM, the solution is to enable the KeepAlive setting in the Utimaco configuration file cs_pkcs11_R2.cfg:

Cannot produce CertificateVerify signature

When using SignClient using a PKCS 11 token (e.g. a smart-card reader) for authenticating in some cases (e.g. both server and client running on Java 11) a cipher-suit-related error can occur:

As a workaround, SignClient can be forced to fallback to use TLS version 1.1 (as shown in the commented-out sample in script bin/signclient, a similar example is also present in the Windows batch file bin/signclient.cmd)