Skip to main content
Unlisted page
This page is unlisted. Search engines will not index it, and only users having a direct link can access it.

Troubleshooting the Code Sign Client

This page lists common issues you may encounter when using the Code Sign Client and provides suggestions for resolving them.

All examples use the pkcs11config utility. If you are using the CSP/KSP client on Windows, replace pkcs11config with cspconfig.

Authentication issues​

"Authentication failed"​

This message indicates that the client could not authenticate with Next-Gen Trust Security (NGTS).

Check the following:

  • Host URL – Ensure you used your TSG endpoint (<tsg-id>.ngts.paloaltonetworks.com), not a tenant UI URL.
  • Client ID – Confirm that the Built-in Account Client ID matches the value shown in the NGTS Built-in Accounts inventory (System Settings > Certificate Settings > Built-in Accounts).
  • Private key – Confirm that the private key file (--keyfile) corresponds to the key pair for this Built-in Account and has not been changed or revoked.
  • Time skew – Make sure the system clock on the signing machine is reasonably accurate. Significant time differences can cause token validation to fail.

You can review stored configuration values with:

pkcs11config option show

No objects available​

"INFO: No objects available."​

This message indicates that the client is authenticated but the Built-in Account cannot find any Signing Keys or certificates.

Verify that:

  • The Built-in Account is scoped to the correct TSG. A Built-in Account can only access Signing Keys within its own TSG (and child TSGs, if it was created on a parent TSG). Confirm the account was created in the TSG where the Signing Keys are configured.

  • The host URLs are correct. The client must point to your TSG endpoint. Confirm the configured URLs with pkcs11config option show. If the HSM Server URL and Auth Server URL do not match your TSG endpoint, update them:

    pkcs11config seturls --hostname <tsg-id>.ngts.paloaltonetworks.com

  • The Client ID is correct. Run pkcs11config option show and compare the Client ID value to what appears in the NGTS Built-in Accounts inventory. Update as necessary with pkcs11config login.

If changes were just made by an administrator, wait a few moments and try again:

pkcs11config list

Label or key selection issues​

"Label not found"​

This occurs when a label specified on the command line does not match any available Signing Key.

  • Re-run pkcs11config list and copy the Label value exactly as shown.
  • Make sure you are authenticated with the correct Built-in Account.

Connectivity or proxy issues​

If the client cannot reach the service, you may see errors related to timeouts or connection failures.

Check the following:

  • The machine has network connectivity to your TSG endpoint.
  • Any required proxy settings have been configured using: 
    pkcs11config proxy --show
  • Firewall rules allow outbound connections to the required endpoints and ports.

If you suspect proxy issues, adjust settings with the pkcs11config proxy command or temporarily disable the proxy to test.

PowerShell signing issues​

"Unsupported hash algorithm: SHA-1" when signing PowerShell scripts​

If Set-AuthenticodeSignature fails with an unsupported hash algorithm: SHA-1 error, the signing request reached the service with a SHA-1 digest. AWS KMS, which can back NGTS Signing Keys, does not support SHA-1. Older service versions surface this as a generic Private Key Access Error or UnknownError.

Windows PowerShell versions prior to 7.3 default to SHA-1 when the -HashAlgorithm parameter is not specified. Pass an explicit hash algorithm to avoid the error:

Set-AuthenticodeSignature -Certificate $devcert -FilePath .\hello.ps1 -HashAlgorithm "SHA256"

PowerShell 7.3 and later default to SHA-256, so the parameter is optional there.

See the PowerShell integration guide for complete instructions.

Trace logging for diagnostics​

If problems persist, enable trace logging to capture more detail:

pkcs11config trace --enable --log --filename <path-prefix>

Reproduce the issue, then review the generated trace files. Once finished, disable tracing:

pkcs11config trace --disable

Resetting configuration​

As a last resort, you can reset the client configuration:

pkcs11config reset --current

This clears the current user configuration while preserving URLs. To remove everything, including URLs:

pkcs11config reset --all

After resetting, you must authenticate again.

Getting more help​

If you still cannot resolve the issue:

  • Capture any error messages and relevant trace logs.
  • Confirm your environment details (operating system, client version, TSG endpoint, and Built-in Account Client ID).
  • Contact your administrator or support with this information.