Certificate and ACME error codes (mpbx-certs)

Raised by certificate uploads, ACME requests and the automatic renewer (W4-SEC-01). Messages never contain a private key, the ACME account key or a challenge's key authorization; they name certificate ids, DNS names and ACME problem types at most. A failed ACME attempt is also recorded on the certificate (last_error_code, renewal_failures) and counted in mpbx_tls_cert_renewal_failures. Guide: certificates.

Code	Kind	Meaning	What to do
MPBX-CERT-NAME-INVALID	invalid_argument	A DNS name is not acceptable: not two or more labels of a-z 0-9 -, longer than 253 characters, an IP address, or a wildcard in an ACME request (HTTP-01 cannot validate wildcards).	Use exact host names for ACME (pbx.example.com); upload a certificate for wildcards.
MPBX-CERT-NAME-NOT-ALLOWED	invalid_argument	A company asked for a certificate for a name that is not its own web address <slug>.<base domain>, or the install has no base domain (http.base_domain) so companies have no address of their own.	Request the company's address (leave domains empty), or manage the certificate install-wide.
MPBX-CERT-NAME-TAKEN	conflict	An ACME request names a certificate that already exists in the scope as an upload or with other names.	Delete the existing certificate first, or upload a new one.
MPBX-CERT-PEM-INVALID	invalid_argument	The PEM text cannot be parsed, is too large (chain 64 KiB, key 16 KiB), has no certificate or no key, has more than one key, or the chain field contains a private key.	Paste the chain (leaf first) and the key into their own fields.
MPBX-CERT-KEY-UNSUPPORTED	invalid_argument	The key type or size is not supported.	Use RSA 2048 bits or more, ECDSA P-256 or P-384, or Ed25519.
MPBX-CERT-KEY-MISMATCH	invalid_argument	The private key does not belong to the first (leaf) certificate of the chain.	Upload the key that was generated with this certificate's request.
MPBX-CERT-CHAIN-INVALID	invalid_argument	The chain is not leaf first, a certificate is not signed by the next one, the first certificate is a CA, or there are more than 10 certificates.	Order the chain: server certificate, then each intermediate (the root is optional).
MPBX-CERT-EXPIRED	invalid_argument	The leaf certificate is expired or not valid yet.	Upload a current certificate. Check the server clock if it is "not valid yet".
MPBX-CERT-NAME-MISMATCH	invalid_argument	The leaf has no DNS names in its subjectAltName, or does not cover the name it is stored for (a company certificate must cover the company's address; an issued ACME certificate must cover every requested name).	Use a certificate issued for the right names.
MPBX-CERT-NOT-FOUND	not_found	No such certificate in this scope. A company's certificate is invisible to other companies, and install-wide certificates are not reachable through the company routes.	Check the id and the scope (/certificates or /system/certificates).
MPBX-CERT-CHANGED	conflict	The certificate changed between the read and the delete.	Read it again and retry with the new ETag.
MPBX-CERT-NOT-ACME	invalid_argument	"Renew now" on an uploaded certificate.	Upload a new certificate instead.
MPBX-CERT-RENEW-TOO-SOON	conflict	A company asked to renew (or re-request) a certificate that was issued less than a day ago. Every order counts against the install's shared ACME rate limits, so one company cannot use them up for the others.	Nothing to do: the certificate renews automatically before it expires. A System Admin can still renew it.
MPBX-CERT-ORDER-QUOTA	conflict	A company administrator placed 5 new ACME certificate orders in the last 24 hours (deleting a certificate and requesting it again counts as a new order). The install's ACME account and registered-domain rate limits are shared by every company.	Wait a day, or ask a System Admin, who is not limited.
MPBX-CERT-CLAIM-LOST	conflict	A renewer stalled past its claim on a certificate (pause, partition) and another node renewed it meanwhile; the late result was dropped. Logged only.	None: the other node's certificate is in service. Frequent occurrences mean orders take longer than the claim (10 minutes).
MPBX-CERT-TLS-CONFIG	internal	The TLS server configuration cannot be built.	Report it: this is a build or platform problem.
MPBX-ACME-NOT-CONFIGURED	config	ACME settings are invalid: tls.acme_directory is not an https:// URL, tls.acme_contact is not an e-mail address, or tls.acme_ca_file is unreadable or holds no certificate.	Fix the [tls] settings (see the guide).
MPBX-ACME-ACCOUNT	config	The ACME account cannot be created or loaded (the CA requires external account binding, the account was deactivated, or the stored credentials are unreadable).	Check the directory URL and the CA's requirements; deleting the acme_accounts row makes the next attempt create a new account.
MPBX-ACME-ORDER	invalid_argument	The CA refused or failed the order (the problem type is in the message), or it returned a certificate that does not validate.	Read the problem type; check the names and the CA's policy (for example CAA records).
MPBX-ACME-CHALLENGE-FAILED	invalid_argument	The CA could not validate HTTP-01: the name does not resolve to this install, port 80 is not reachable from the internet, or a proxy does not forward /.well-known/acme-challenge/. Retried with backoff (10 minutes, doubling, up to 12 hours).	Point the DNS name at the install, open port 80 (tls.http_listen), and use "renew now" to retry immediately.
MPBX-ACME-RATE-LIMITED	unavailable	The CA rate-limited the request. The next attempt waits at least 3 hours.	Wait; avoid deleting and re-requesting certificates repeatedly.
MPBX-ACME-TIMEOUT	unavailable	The CA did not finish the order in time (2 minutes). Retried with backoff.	None usually; check the CA's status page if it persists.
MPBX-ACME-UNREACHABLE	unavailable	The ACME directory cannot be reached (DNS, firewall, TLS trust). Retried with backoff.	Allow outbound HTTPS to the CA; for a private CA set tls.acme_ca_file.