Skip to content

Keystore Generation Error

URI: https://docs.ankatech.co/errors/keystore
HTTP Status: 500 Internal Server Error

When you see this

A keystore could not be generated or manipulated because of a server-side fault. This type is raised by the Admin API and, like every 500, means the failure could not be attributed to your request.

This is not a retryable condition

A 500 from this type is a server fault, not a transient one — retrying will produce the identical result. Genuinely transient conditions are reported as a 503 with a Retry-After header, and a backend that was never bound is reported as a 409. Neither arrives here.

Common Causes

  • A cryptographic provider failed to initialize, or a required algorithm was unavailable to it.
  • A keystore file or entry is corrupt, or is in a format the platform cannot read.
  • The server had insufficient resources (entropy, memory, file handles) to complete key generation.
  • The storage layer refused the read or write — for example a filesystem permission problem.

What does NOT arrive here. A Hardware Security Module or Cloud KMS that is unbound, unreachable or misconfigured is reported as its own typed key-protection refusal, not as this type:

  • 409 key-protection-backend-not-configured — the backend was never bound. Complete setup; do not retry.
  • 503 key-protection-backend-unavailable, with Retry-After — a transient backend outage. Retry after the stated delay.
  • 503 key-protection-backend-misconfigured, without Retry-After — a durable misconfiguration, such as an incorrect PIN. Retrying re-presents the wrong credential, and a PKCS#11 token locks its user PIN after a few failed login attempts.

These bodies are deliberately backend-agnostic: they name no token, label, slot, vendor, PIN or driver return code.

How to Resolve

  1. Do not retry. The condition is not transient.
  2. If you are creating a keystore, confirm every supplied parameter is valid and the requested keystore type and algorithm are supported.
  3. Record the correlation identifier and report it. The Admin API carries it as extensions.requestId in the response body, and every service also returns it in the X-Correlation-Id response header — see Where extension members live.
  4. Ask your administrator to correlate that identifier with the server-side log, which carries the diagnosable cause. The response body deliberately does not.

This is an internal server error. If the problem persists, contact AnkaSecure support with the correlation identifier and the approximate timestamp.