Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Pemecahan masalah
Halaman ini menunjukkan cara menyelesaikan masalah umum terkait Certificate Authority Service.
Permintaan API menampilkan HTTP 403 Forbidden
Jika permintaan API menampilkan HTTP 403 Forbidden dengan pesan Read access to project PROJECT_NAME was denied, gunakan resolusi berikut.
Resolusi
- Periksa izin IAM pemohon.
- Periksa lokasi untuk permintaan tersebut. Region yang tidak didukung dapat menampilkan error izin ditolak. Untuk mengetahui informasi selengkapnya tentang lokasi yang didukung, lihat Lokasi.
Menghapus CA akan menampilkan HTTP 412 Prasyarat Gagal
Jika Anda melihat error prasyarat gagal berikut saat menghapus CA, gunakan penyelesaian di bagian ini.
Cannot perform Certificate Authority deletion, Certificate Authority is in state ENABLED.
Resolusi
CA harus dalam status DISABLED atau STAGED agar dapat dihapus. Pastikan status CA Anda sebelum menjadwalkan penghapusannya. Untuk mengetahui informasi selengkapnya tentang status CA, lihat Status CA.
Kegagalan penerbitan sertifikat
CA Service menyediakan beberapa kontrol kebijakan yang dapat Anda gunakan untuk mengelola penerbitan sertifikat. Untuk mengetahui informasi selengkapnya tentang kontrol kebijakan, lihat Ringkasan template sertifikat dan kebijakan penerbitan.
Penerbitan sertifikat dapat gagal karena beberapa alasan. Beberapa alasan tersebut adalah sebagai berikut.
Konflik antara kebijakan penerbitan sertifikat dan template sertifikat kumpulan CA.
Misalnya, pertimbangkan bahwa kebijakan penerbitan menentukan ekstensi foo dan menetapkan nilai bar dan template sertifikat menentukan ekstensi foo dan menetapkan nilai bat. Menetapkan dua nilai yang berbeda ke ekstensi yang sama akan menimbulkan konflik.
Resolusi
Tinjau kebijakan penerbitan sertifikat kumpulan CA terhadap template sertifikat, serta identifikasi dan selesaikan konflik.
Untuk informasi selengkapnya tentang kebijakan penerbitan, lihat Menambahkan kebijakan penerbitan sertifikat ke kumpulan CA.
Nama Subjek atau Nama Alternatif Subjek (SAN) gagal dalam evaluasi ekspresi CEL di template sertifikat atau kebijakan penerbitan sertifikat kumpulan CA.
Resolusi
Tinjau kebijakan penerbitan sertifikat dan template sertifikat kumpulan CA, serta pastikan subjek dan SAN memenuhi kondisi yang ditetapkan oleh ekspresi Common Expression Language (CEL). Untuk informasi selengkapnya tentang ekspresi CEL, lihat Menggunakan Common Expression Language.
Peran IAM yang salah diberikan untuk kasus penggunaan. Misalnya, menetapkan peran roles/privateca.certificateRequester untuk identitas yang direfleksikan atau menetapkan peran roles/privateca.workloadCertificateRequester untuk mode identitas default.
Resolusi
Pastikan Anda telah menetapkan peran roles/privateca.certificateRequester untuk mode identitas default dan peran roles/privateca.workloadCertificateRequester untuk identitas yang direfleksikan. Untuk informasi selengkapnya tentang penggunaan refleksi identitas, lihat Refleksi identitas untuk workload gabungan.
Mencoba menggunakan mode identitas yang direfleksikan dalam skenario yang tidak didukung, seperti tanpa identitas beban kerja Hub. Skenario yang tidak didukung untuk refleksi identitas akan menampilkan pesan error berikut:
Could not use the REFLECTED_SPIFFE subject mode because the caller does not have a SPIFFE identity. Please visit the CA Service documentation to ensure that this is a supported use-case.
Resolusi
Tentukan jenis identitas yang perlu Anda gunakan: identitas default atau identitas yang direfleksikan. Jika Anda perlu menggunakan identitas yang ditampilkan, pastikan Anda menggunakannya dalam salah satu skenario yang didukung. Untuk informasi selengkapnya tentang refleksi identitas, lihat Refleksi identitas untuk workload gabungan.
Batasan ukuran kunci default menolak kunci RSA dengan ukuran modulus kurang dari
2048 bit.
Praktik terbaik industri merekomendasikan penggunaan kunci RSA minimal 2048 bit.
Secara default, Layanan CA mencegah penerbitan sertifikat menggunakan
kunci RSA yang ukuran modulusnya kurang dari 2048 bit.
Resolusi
Jika ingin menggunakan kunci RSA dengan ukuran modulus kurang dari 2048 bit, Anda harus
mengizinkannya secara eksplisit menggunakan kebijakan penerbitan sertifikat.
Gunakan contoh YAML berikut untuk mengizinkan kunci RSA tersebut:
allowedKeyTypes:
- rsa:
minModulusSize: 1024
Langkah selanjutnya
Kecuali dinyatakan lain, konten di halaman ini dilisensikan berdasarkan Lisensi Creative Commons Attribution 4.0, sedangkan contoh kode dilisensikan berdasarkan Lisensi Apache 2.0. Untuk mengetahui informasi selengkapnya, lihat Kebijakan Situs Google Developers. Java adalah merek dagang terdaftar dari Oracle dan/atau afiliasinya.
Terakhir diperbarui pada 2025-09-04 UTC.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis page provides solutions for common issues encountered with Certificate Authority Service, including API errors, CA deletion problems, and certificate issuance failures.\u003c/p\u003e\n"],["\u003cp\u003eAn HTTP 403 Forbidden error on API requests can be resolved by checking the requester's IAM permissions and ensuring the request location is supported.\u003c/p\u003e\n"],["\u003cp\u003eTo delete a CA, it must be in the \u003ccode\u003eDISABLED\u003c/code\u003e or \u003ccode\u003eSTAGED\u003c/code\u003e state, otherwise you will get an HTTP 412 error, so you must ensure the CA's state before attempting deletion.\u003c/p\u003e\n"],["\u003cp\u003eCertificate issuance failures may arise from conflicts between CA pool policies and certificate templates, incorrect IAM role assignments, or unsupported identity reflection scenarios, which can all be resolved by reviewing and correcting those settings.\u003c/p\u003e\n"],["\u003cp\u003eCertificate issuance can be blocked if the RSA key's modulus size is less than 2048 bits, but you can explicitly allow smaller keys through the certificate issuance policy.\u003c/p\u003e\n"]]],[],null,["# Troubleshooting\n===============\n\nThis page shows you how to resolve common issues with Certificate Authority Service.\n\nAPI request returns HTTP 403 Forbidden\n--------------------------------------\n\nIf an API request returns HTTP 403 Forbidden with the message `Read access to project PROJECT_NAME was denied`, then use the following resolution.\n\n**Resolution**\n\n1. Check the IAM permissions of the requester.\n2. Check the location for the request. Unsupported regions can return a permission denied error. For more information about supported locations, see [Locations](/certificate-authority-service/docs/locations).\n\nDeleting a CA returns HTTP 412 Failed Precondition\n--------------------------------------------------\n\nIf you see the following failed precondition errors when deleting a CA, use the resolution in this section.\n\n- `Cannot perform Certificate Authority deletion, Certificate Authority is in state ENABLED.`\n\n**Resolution**\n\nA CA needs to be in `DISABLED` or `STAGED` state for it to be deleted. Ensure the state of your CA before scheduling it for deletion. For more information about CA states, see [CA states](/certificate-authority-service/docs/certificate-authority-states).\n\nCertificate issuance failure\n----------------------------\n\nCA Service provides several policy controls that you can use to manage certificate issuance. For more information about the policy controls, see [Overview of certificate templates and issuance policies](/certificate-authority-service/docs/policy-controls).\n\nCertificate issuance can fail because of several reasons. Some of these reasons are as follows.\n\n- Conflict between CA pool's certificate issuance policy and certificate template.\n\n For example, consider that the issuance policy defines an extension `foo` and assigns it the value `bar` and the certificate template defines extension `foo` and assigns it the value `bat`. Assigning two different values to the same extension creates a conflict.\n\n **Resolution**\n\n Review the CA pool's certificate issuance policy against the certificate template, and identify and resolve the conflicts.\n\n For more information about issuance policies, see [Add a certificate issuance policy to a CA pool](/certificate-authority-service/docs/use-issuance-policy).\n- Subject or Subject Alternate Names (SANs) fail the CEL expression evaluation in either the certificate template or the CA pool's certificate issuance policy.\n\n **Resolution**\n\n Review the CA pool's certificate issuance policy and certificate template, and ensure that the subject and SAN satisfy the conditions set by Common Expression Language (CEL) expressions. For more information about CEL expressions, see [Using Common Expression Language](/certificate-authority-service/docs/using-cel).\n- Incorrect IAM role being granted for a use case. For example, assigning the `roles/privateca.certificateRequester` role for reflected identity or assigning the `roles/privateca.workloadCertificateRequester` role for default identity mode.\n\n **Resolution**\n\n Confirm that you have assigned the `roles/privateca.certificateRequester` role for default identity mode and the `roles/privateca.workloadCertificateRequester` role for reflected identity. For more information about using identity reflection, see [Identity reflection for federated workloads](/certificate-authority-service/docs/using-identity-reflection).\n- Attempting to use the reflected identity mode in an unsupported scenario, such as without Hub workload identity. An unsupported scenario for identity reflection returns the following error message:\n\n ```\n Could not use the REFLECTED_SPIFFE subject mode because the caller does not have a SPIFFE identity. Please visit the CA Service documentation to ensure that this is a supported use-case.\n ```\n\n **Resolution**\n\n Determine which type of identity you need to use: default identity or reflected identity. If you need to use reflected identity, make sure that you are using it in one of the supported scenarios. For more information about identity reflection, see [Identity reflection for federated workloads](/certificate-authority-service/docs/using-identity-reflection).\n- The default key size restriction rejects RSA keys with modulus size less than\n 2048 bits.\n\n Industry best practices recommend using an RSA key of at least 2048 bits.\n By default, CA Service prevents issuing certificates using an\n RSA key whose modulus size is less than 2048 bits.\n\n **Resolution**\n\n If you want to use a RSA key with modulus size less than 2048 bits, you must\n explicitly allow it [using the certificate issuance policy](/certificate-authority-service/docs/use-issuance-policy#gcloud).\n Use the following YAML example to allow such RSA keys: \n\n allowedKeyTypes:\n - rsa:\n minModulusSize: 1024\n\nWhat's next\n-----------\n\n- Learn about the [best practices for using Certificate Authority Service](/certificate-authority-service/docs/best-practices).\n- [Frequently asked questions](/certificate-authority-service/docs/faqs)"]]
