Error entering certificate in CTL

[13567436138]

Error: signing [quay.mark.demo/admin/buildah-demo@sha256:de918065cb3877e4bb9cfdfdc0777ecc3ba938f17fbd7fd7d62f3e12a11bb32f]: signing digest: signing bundle: error signing bundle: Fulcio returned 500: {"code":13, "message":"Error entering certificate in CTL", "details":[]}
error during command execution: signing [quay.mark.demo/admin/buildah-demo@sha256:de918065cb3877e4bb9cfdfdc0777ecc3ba938f17fbd7fd7d62f3e12a11bb32f]: signing digest: signing bundle: error signing bundle: Fulcio returned 500: {"code":13, "message":"Error entering certificate in CTL", "details":[]}

[13567436138]

Croot@ubuntu:~# kubectlogs -n fulcio-system fulcio-server-6874bdb7d-nj55t |grep error
2025-12-22T12:35:16.603Z ERROR server/error.go:59 got HTTP status "400 Bad Request" {"requestID": "kCsGiJ3p", "code": "Internal", "clientMessage": "Error entering certificate in CTL", "error": "got HTTP status "400 Bad Request""}
github.com/sigstore/fulcio/pkg/server/error.go:59
2025-12-22T12:35:16.603Z DEBUG log/log.go:106 finished unary call with code Internal {"grpc.start_time": "2025-12-22T12:35:16Z", "system": "grpc", "span.kind": "server", "grpc.service": "dev.sigstore.fulcio.v2.CA", "grpc.method": "CreateSigningCertificate", "error": "rpc error: code = Internal desc = Error entering certificate in CTL", "grpc.code": "Internal", "requestID": "kCsGiJ3p", "grpc.time_ms": 44.934}
2025-12-22T12:35:17.611Z ERROR server/error.go:59 got HTTP status "400 Bad Request" {"requestID": "BYpZk_4l", "code": "Internal", "clientMessage": "Error entering certificate in CTL", "error": "got HTTP status "400 Bad Request""}
github.com/sigstore/fulcio/pkg/server/error.go:59
2025-12-22T12:35:17.611Z DEBUG log/log.go:106 finished unary call with code Internal {"grpc.start_time": "2025-12-22T12:35:17Z", "system": "grpc", "span.kind": "server", "grpc.service": "dev.sigstore.fulcio.v2.CA", "grpc.method": "CreateSigningCertificate", "error": "rpc error: code = Internal desc = Error entering certificate in CTL", "grpc.code": "Internal", "requestID": "BYpZk_4l", "grpc.time_ms": 3.349}

root@ubuntu:~# kubectl logs -n ctlog-system ctlog-85876f4c79-zjtdq |grep error
W1222 12:35:16.561742 1 handlers.go:208] fulcio{7449846488620557711}: AddPreChain handler error: failed to verify add-chain contents: chain failed to verify: x509: certificate signed by unknown authority (possibly because of "x509: ECDSA verification failure" while trying to verify candidate authority certificate "Linux Foundation")
W1222 12:35:17.569689 1 handlers.go:208] fulcio{7449846488620557711}: AddPreChain handler error: failed to verify add-chain contents: chain failed to verify: x509: certificate signed by unknown authority (possibly because of "x509: ECDSA verification failure" while trying to verify candidate authority certificate "Linux Foundation")

[13567436138]

is this ca of tsa or fulcio,I did not find fulcio ca in secret?

root@ubuntu:~# kubectl get secret -n fulcio-system fulcio-server-secret -o yaml
apiVersion: v1
data:
  cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNOakNDQWR5Z0F3SUJBZ0lIZkZ3TzdubHczekFLQmdncWhrak9QUVFEQWpCK01Rd3dDZ1lEVlFRR0V3TlYKVTBFeEV6QVJCZ05WQkFnVENrTmhiR2xtYjNKdWFXRXhGakFVQmdOVkJBY1REVk5oYmlCR2NtRnVZMmx6WTI4eApGakFVQmdOVkJBa1REVFUwT0NCTllYSnJaWFFnVTNReERqQU1CZ05WQkJFVEJUVTNNamMwTVJrd0Z3WURWUVFLCkV4Qk1hVzUxZUNCR2IzVnVaR0YwYVc5dU1CNFhEVEkxTVRJeU1qRXhNemMxT1ZvWERUSTJNVEl5TWpFeE16YzEKT1Zvd2ZqRU1NQW9HQTFVRUJoTURWVk5CTVJNd0VRWURWUVFJRXdwRFlXeHBabTl5Ym1saE1SWXdGQVlEVlFRSApFdzFUWVc0Z1JuSmhibU5wYzJOdk1SWXdGQVlEVlFRSkV3MDFORGdnVFdGeWEyVjBJRk4wTVE0d0RBWURWUVFSCkV3VTFOekkzTkRFWk1CY0dBMVVFQ2hNUVRHbHVkWGdnUm05MWJtUmhkR2x2YmpCWk1CTUdCeXFHU000OUFnRUcKQ0NxR1NNNDlBd0VIQTBJQUJFN0Y0QjR6OC9pS2JsRElrZmxJSm02MmhwbzhuSHZ5RGxwMTRDTXlDM0FmWkVWbApvUnVFM0IyVjNqbDgzK0RieEdZNysxQWF0emlETFJ6ZGRvemxNeHFqUlRCRE1BNEdBMVVkRHdFQi93UUVBd0lCCkJqQVNCZ05WSFJNQkFmOEVDREFHQVFIL0FnRUJNQjBHQTFVZERnUVdCQlROeTl4MlBZZG5pUFZmSVh1OXU3WlYKY0NwRkl6QUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpRUF3bUIrc1QvR0pScHdLS0hCbzlNYndsMUpuU1lxUFplSQpHRy9XSFlxZCtDTUNJRlhuMTA1MElXbHo3aGVsbHNIN2ViTHhoOE1pYUplQUVwMzhqejQwbHd3WAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  password: OGY5MDI0Y2YtMzZjMy00Mzg2LTg3YTctNzAwODYwYThkN2E5
  private: LS0tLS1CRUdJTiBFTkNSWVBURUQgUFJJVkFURSBLRVktLS0tLQpNSUgxTUdBR0NTcUdTSWIzRFFFRkRUQlRNRElHQ1NxR1NJYjNEUUVGRERBbEJCQ2FkRW52aDlFYTUvbVY0bHk0CndSTHZBZ01KSjhBd0RBWUlLb1pJaHZjTkFna0ZBREFkQmdsZ2hrZ0JaUU1FQVNvRUVPYmRzNUtzeW5YcU5wZFUKR2Y5UUg2a0VnWkM2cERWbGVZRkdVUWlmbEZKenZaWnRRSGtuVkJhcW9yWmpnY3ZoWGpyYkFLWXlsUCsrMUJnVAprMmhFVTVwSTdTSVpBTVR2TVNvOU1sYVY1VzJpZUQ2bmNPamJBbXQ4NW5HMkFRenhMNVUzVFJnMllobFhDYVpOCitKckRaTGR6STM0YUxPSEF4a3FTcVd2cWgrV2UyYTl0azVNSWd2QURSTjdXN3Q3ZVFpak9CL29SZGYralFVdlQKZnVFRUxEV1FkbDQ9Ci0tLS0tRU5EIEVOQ1JZUFRFRCBQUklWQVRFIEtFWS0tLS0tCg==
  public: LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFVHNYZ0hqUHorSXB1VU1pUitVZ21icmFHbWp5YwplL0lPV25YZ0l6SUxjQjlrUldXaEc0VGNIWlhlT1h6ZjROdkVaanY3VUJxM09JTXRITjEyak9VekdnPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg==
kind: Secret
metadata:
  creationTimestamp: "2025-12-16T11:10:51Z"
  name: fulcio-server-secret
  namespace: fulcio-system
  resourceVersion: "8362225"
  uid: ff8d28ca-f813-4a18-9931-c7d912a68869
type: Opaque
root@ubuntu:~# kubectl get secret -n fulcio-system fulcio-pub-key -o yaml
apiVersion: v1
data:
  cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNOakNDQWR5Z0F3SUJBZ0lIZkZ3TzdubHczekFLQmdncWhrak9QUVFEQWpCK01Rd3dDZ1lEVlFRR0V3TlYKVTBFeEV6QVJCZ05WQkFnVENrTmhiR2xtYjNKdWFXRXhGakFVQmdOVkJBY1REVk5oYmlCR2NtRnVZMmx6WTI4eApGakFVQmdOVkJBa1REVFUwT0NCTllYSnJaWFFnVTNReERqQU1CZ05WQkJFVEJUVTNNamMwTVJrd0Z3WURWUVFLCkV4Qk1hVzUxZUNCR2IzVnVaR0YwYVc5dU1CNFhEVEkxTVRJeU1qRXhNemMxT1ZvWERUSTJNVEl5TWpFeE16YzEKT1Zvd2ZqRU1NQW9HQTFVRUJoTURWVk5CTVJNd0VRWURWUVFJRXdwRFlXeHBabTl5Ym1saE1SWXdGQVlEVlFRSApFdzFUWVc0Z1JuSmhibU5wYzJOdk1SWXdGQVlEVlFRSkV3MDFORGdnVFdGeWEyVjBJRk4wTVE0d0RBWURWUVFSCkV3VTFOekkzTkRFWk1CY0dBMVVFQ2hNUVRHbHVkWGdnUm05MWJtUmhkR2x2YmpCWk1CTUdCeXFHU000OUFnRUcKQ0NxR1NNNDlBd0VIQTBJQUJFN0Y0QjR6OC9pS2JsRElrZmxJSm02MmhwbzhuSHZ5RGxwMTRDTXlDM0FmWkVWbApvUnVFM0IyVjNqbDgzK0RieEdZNysxQWF0emlETFJ6ZGRvemxNeHFqUlRCRE1BNEdBMVVkRHdFQi93UUVBd0lCCkJqQVNCZ05WSFJNQkFmOEVDREFHQVFIL0FnRUJNQjBHQTFVZERnUVdCQlROeTl4MlBZZG5pUFZmSVh1OXU3WlYKY0NwRkl6QUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpRUF3bUIrc1QvR0pScHdLS0hCbzlNYndsMUpuU1lxUFplSQpHRy9XSFlxZCtDTUNJRlhuMTA1MElXbHo3aGVsbHNIN2ViTHhoOE1pYUplQUVwMzhqejQwbHd3WAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  public: LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFVHNYZ0hqUHorSXB1VU1pUitVZ21icmFHbWp5YwplL0lPV25YZ0l6SUxjQjlrUldXaEc0VGNIWlhlT1h6ZjROdkVaanY3VUJxM09JTXRITjEyak9VekdnPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCg==
kind: Secret
metadata:
  creationTimestamp: "2025-12-16T11:10:51Z"
  name: fulcio-pub-key
  namespace: fulcio-system
  resourceVersion: "8362227"
  uid: fda4270f-525f-45d3-9b5f-e895da7bc4c0
type: Opaque

[13567436138]

root@ubuntu:~# kubectl get pod -n fulcio-system fulcio-server-6874bdb7d-nj55t -o yaml|grep ct-log
    - --ct-log-url=http://ctlog.ctlog-system.svc/fulcio
root@ubuntu:~# kubectl get svc -n ctlog-system 
NAME    TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)           AGE
ctlog   ClusterIP   10.85.53.167   <none>        80/TCP,6963/TCP   6d1h

[13567436138]

I am using gitlab self-hosted:

ctlog:
  enabled: true  
  namespace:
    create: true
    name: ctlog-system
  server:
    image:
      registry: quay.mark.demo
      repository: admin/ct_server
      pullPolicy: IfNotPresent
      version: v0.7.24
    ingress:
      enabled: true
      className: traefik
      hosts:
      - path: /
        host: ctlog.mark.demo
  createtree:
    enabled: true
    image:
      registry: quay.mark.demo
      repository: admin/createtree
      pullPolicy: IfNotPresent
      version: v0.7.24
  createctconfig:
    enabled: true
    initContainerImage:
      curl:
        registry: quay.mark.demo
        repository: admin/curl
        version: 8.14.1
    image:
      registry: quay.mark.demo
      repository: admin/createctconfig
      pullPolicy: IfNotPresent
      version: v0.7.24
namespace:
  create: false
  name: fulcio-system
config:
  format: yaml
  contents: 
    define:
      - &github-type "github-workflow"
      - &gitlab-type "gitlab-pipeline"
      - &codefresh-type "codefresh-workflow"
      - &buildkite-type "buildkite-job"
      - &circleci-type "circleci-job"
    oidc-issuers:
      http://gitlab.gitlab.demo:
        issuer-url: http://gitlab.gitlab.demo
        client-id: sigstore
        type: ci-provider
        ci-provider: *gitlab-type
        contact: support@gitlab.com
        description: "GitLab OIDC tokens for job identity"
    ci-issuer-metadata:
      *gitlab-type:
        default-template-values:
          url: "http://gitlab.gitlab.demo"
          # Nil default value to handle optional environment claim
          environment: ""
        extension-templates:
          # url: The URL of the GitLab instance. https://gitlab.com
          # ci_config_ref_uri: Ref of top-level pipeline definition.
          # E.g. gitlab.com/my-group/my-project//.gitlab-ci.yml@refs/heads/main
          build-signer-uri: "http://{{ .ci_config_ref_uri }}"
          # ci_config_sha: Commit sha of top-level pipeline definition, and is
          # only populated when `ciConfigRefURI` is local to the GitLab instance
          build-signer-digest: "ci_config_sha"
          # runner_environment: The type of runner used by the job. May be one of gitlab-hosted or self-hosted.
          runner-environment: "runner_environment"
          # project_path: Repository path building built
          source-repository-uri: "{{ .url }}/{{ .project_path }}"
          # sha: Commit SHA being built
          source-repository-digest: "sha"
          # ref_type: The type of the ref
          # E.g. "branch", "tag"
          # ref: Git ref being built
          source-repository-ref: refs/{{if eq .ref_type "branch"}}heads/{{ else }}tags/{{end}}{{ .ref }}
          # project_id: ID to the source repo
          source-repository-identifier: "project_id"
          # namespace_path: Owner of the source repo (mutable)
          source-repository-owner-uri: "{{ .url }}/{{ .namespace_path }}"
          # namespace_id: ID of the source repo
          source-repository-owner-identifier: "namespace_id"
          build-config-uri: "http://{{ .ci_config_ref_uri }}"
          build-config-digest: "ci_config_sha"
          # pipeline_source: Event that triggered this workflow run. E.g "push", "tag" etc
          build-trigger: "pipeline_source"
          # project_path: Repository building built
          # job_id: job ID
          run-invocation-uri: "{{ .url }}/{{ .project_path }}/-/jobs/{{ .job_id }}"
          # project_visibility: Visibility of the source project
          source-repository-visibility-at-signing: "project_visibility"
          # environment: Deployment target for job (optional)
          deployment-environment: "environment"
        subject-alternative-name-template: "http://{{ .ci_config_ref_uri }}"
server:
  image:
    registry: quay.mark.demo
    repository: admin/fulcio
    pullPolicy: IfNotPresent
    version: v1.8.2
  args:
    port: 5555
    grpcPort: 5554
    certificateAuthority: fileca
    # kms_resource: gcpkms://....
    # kms_cert_chain: |-
    #   << your PEM encoded cert chain here. Order from active intermedate first to root last >>
    hsm_caroot_id:
    aws_hsm_root_ca_path:
    gcp_private_ca_parent: projects/test/locations/us-east1/caPools/test
    ct_log_url: ""
    disable_ct_log: false
  ingress:
    http:
      enabled: true
      className: "traefik"
      hosts:
      - path: /
        host: "fulcio.mark.demo"
    grpc:
      enabled: false
      className: ""
      annotations:
        nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
      hosts:
        - host: fulcio.localhost
          path: /dev.sigstore.fulcio.v2.CA
      tls:
        - secretName: fulcio-grpc-ingress-tls
          hosts:
            - fulcio.localhost
createcerts:
  enabled: true
createcerts:
  enabled: true
  replicaCount: 1
  name: createcerts
  image:
    registry: quay.mark.demo
    repository: admin/createcerts
    pullPolicy: IfNotPresent
    version: v0.7.24