Troubleshooting, Services, and Logs

Below are common issues with their corresponding resolution or investigation techniques. Additional details about your installation can also be found in the Windows Services settings on your server and in the AnyCAGateway REST log files.

Configuration Files

To view the saved configuration and encrypted installation data:

1. Navigate to the location of the AnyCAGateway REST configuration folder, by default at:

   C:\Program Files\Keyfactor\Keyfactor AnyCA Gateway\AnyGatewayREST\configuration

2. Open the folder to view the saved configuration and encrypted installation data, including:

   • The configuration data for the gateway. This information is editable.

     appsettings.json

   • The configuration data for any shared assemblies.

     sharedAssemblies.json

   • The database connection string, which has been encrypted.

     SQLSecret.json

   • The root CA A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. certificate referenced by the -AuthCAFilePath parameter A parameter or argument is a value that is passed into a function in an application. on install. The file name will vary depending on the name of the file provided. This file only exists for implementations using client certificate authentication.

     [RootCA].crt

   • The logging configuration file. See Logs for more information.

     nlog.config

Logs

When troubleshooting, both the AnyCA Gateway logs and the Keyfactor Command logs can be helpful resources.

Understanding Log Files

Log files by default are generated using the following layout:

• Timestamp: The date and time the log was generated, in format.

  Example: 2026-02-11 11:35:21.1402

• Correlation ID: A system-generated GUID that identifies all log messages from a single request. It typically appears immediately after the timestamp.

  Example: c41cf6c5-b1ef-4f09-a52c-3de0c06da55b

  The correlation ID appears at all logging levels.

• Logger Name: The fully qualified class or namespace where the log message originated. Useful for filtering or tracing specific components.

  Example: Microsoft.AspNetCore.Hosting.Diagnostics

• Log Level: Indicates the severity of the message—ranging from Trace and Debug (low-level detail) to Info, Warn, Error, and Fatal (critical failures).

• Message: The main content of the log entry. This may include descriptive text, data values, or stack traces in the case of errors.

  Example:

  Request finished HTTP/2 GET https://websrvr33.keyexample.com/AnyGatewayREST/IdentityProviders - 200 1830 application/json;+charset=utf-8 17.7307ms
  Tip:  Some messages, such as this one, indicate the processing time of the request in the message (17.7307ms).

The above references as found in a full log entry would look like:

Installations on Windows

Keyfactor Command Logs:

• By default, Keyfactor Command installed on Windows under IIS outputs logging information to both the Windows event log and the local file system, places file system log files in the C:\Keyfactor\logs directory, generates file system logs at the Info logging level, and stores the primary file system logs for two days before deleting them.

• The Command_Service_Log.txt and Command_API An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command._Log.txt may be helpful for troubleshooting CA sync errors between Keyfactor Command and the AnyCA Gateway.

AnyCAGateway REST Logs:

By default, the AnyCAGateway REST installed on Windows generates logs at the Info logging level, stores logs for two days before deleting them, and places its log files in the following directory:

If you want to change these defaults:

1. On the AnyCAGateway REST server where you want to adjust logging, open a text editor (for example, Notepad) using the Run as administrator option.

2. In the text editor, browse to open the Nlog.config file on the configuration directory under the directory in which you installed the AnyCAGateway REST. By default, this is the following directory:

   C:\Program Files\Keyfactor\Keyfactor AnyCA Gateway\AnyGatewayREST\Configuration
3. Your Nlog.config file may have a slightly different layout than shown here, but the fields you may want to edit are:

   • The logDirectory variable:

     name="logDirectory" value="logs/"

     Example new value:

     name="logDirectory" value="D:\GatewayLogs\logs/"
     Important:  If you choose to change the path for storage of the log files, you will may need to create the new directory (for example, D:\GatewayLogs) and grant the service account under which the CA gateway service runs full control permissions on this directory, depending on what service account the gateway as running as. If the gateway is running as Network Service, it should have sufficient permissions to create the directory and switch the location to a local directory without this.

   • The path and file name of the active CA gateway log file:

     fileName="${logDirectory}/CA_Gateway_Log.txt"

   • The path and file name of previous days' CA gateway log files:

     archiveFileName="${logDirectory}/CA_Gateway_Log_Archive_{#}.txt"

     The CA gateway rotates log files daily and names the previous files using this naming convention.

   • The number of archive files to retain before deletion:

     maxArchiveFiles="2"

   • The level of log detail that should be generated:

     name="*" minlevel="Info"

     The default Info level logs error and some informational data but at a minimal level to avoid generating large log files. For troubleshooting, it may be desirable to set the logging level to Debug or Trace. Available log levels (in order of increasing verbosity) are:

     • OFF: Turns off logging.

     • FATAL: Logs severe errors that cause early termination.

     • ERROR: Logs severe errors and other runtime errors or unexpected conditions that do not cause early termination.

     • WARN: Logs warnings such as deprecated API usage, poor API usage, and other undesirable or unexpected runtime conditions.

     • INFO: Logs all the above, plus general runtime events such as startup and shutdown.

     • DEBUG: Logs all the above, plus detailed information about system behavior and execution flow.

     • TRACE: Logs all available information. This level can result in significant log volume.

<nlog autoReload="true"
   internalLogFile="logs/NLog.txt"
   internalLogLevel="Error"
   throwExceptions="false"
   throwConfigExceptions="false"
   xmlns="http://www.nlog-project.org/schemas/NLog.xsd"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

   <extensions>
      <add assembly="NLog.WindowsEventLog"/>
   </extensions>
   <variable name="logDirectory" value="logs/"/>
   <targets>
   <target name="buffered_wrapper" xsi:type="BufferingWrapper" slidingTimeout="true" bufferSize="500" flushTimeout="500">
        <target xsi:type="File" name="logfile" fileName="${logDirectory}/CA_Gateway_Log.txt" layout="${longdate} ${logger} [${level}] - ${message}"
            archiveFileName="${logDirectory}/CA_Gateway_Log_Archive_{#}.txt" archiveEvery="Day" archiveNumbering="Rolling" maxArchiveFiles="2"/>
   </target>
   <target xsi:type="EventLog" name="eventLog" source="CA Gateway"
      eventId="${event-properties:item=eventID}" category="${event-properties:item=categoryID}" layout="${event-properties:item=eventMessage}" />
   </targets>

   <rules>
      <logger name="*-EVENT" minLevel="Info" writeTo="eventLog" final="true" />
      <!-- Don't write events to the log file (log file should contain different, more verbose, logging) -->
      <logger name="*" minlevel="Info" writeTo="logfile">
         <filters defaultAction="Neutral">
            <!-- Don't log raw data dumps -->
            <when condition="level = LogLevel.Trace and length('${message}') &gt; 1000" action="Ignore" />
            <!-- These classes write extremely verbose logging that is generally not needed in the course of regular troubleshooting -->
            <when condition="starts-with('${logger}', 'CertTransBlobEncoder') and level &lt; LogLevel.Info" action="Ignore" />
            <when condition="starts-with('${logger}', 'CertificateRequestDecode') and level &lt; LogLevel.Info" action="Ignore" />
            <when condition="ends-with('${logger}', 'EntrustCertificateRecord') and level &lt; LogLevel.Info" action="Ignore" />
            <when condition="starts-with('${logger}', 'Microsoft.') and level &lt; LogLevel.Info" action="Ignore" />
         </filters>
      </logger>
   </rules>
</nlog>

Figure 819: NLog.config File for the AnyCAGateway REST

Installations in Containers under Kubernetes

By default, the AnyCAGateway REST installed in containers under Kubernetes outputs logging information to the standard Kubernetes logging system and generates file system logs at the Info logging level. The logging level can be configured in the custom values file with the workloadDefaults > logLevel parameter. For a complete list of the parameters, see Values File Settings for Containers Under Kubernetes. The supported log levels are:

• OFF: No logging

• FATAL: Log severe errors that cause early termination

• ERROR: Log severe errors and other runtime errors or unexpected conditions that may not cause early termination

• WARN: Log errors and use of deprecated APIs, poor use of APIs, almost errors, and other runtime situations that are undesirable or unexpected but not necessarily wrong

• INFO: Log all the above plus runtime events (startup/shutdown)

• DEBUG: Log all the above plus detailed information on the flow through the system

• TRACE: Maximum log information—this option can generate large log files

The maximum size and number of logs to retain are controlled with the following Kubernetes configuration settings:

• containerLogMaxWorkers

• containerLogMonitorInterval

For more information, see:

https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation

Log customizations can be added using a custom nlog.config file to add, for example, log filters or reference third-party libraries or other files that support log aggregation.

For container installations under Kubernetes, custom NLog configuration can be added with either a config map or a persistent volume. If you’re just adding filters, a config map is the simpler route, though with a persistent volume subsequent changes to the nlog.config file will be loaded dynamically and will not require a restart or upgrade of the containers. If you need to include libraries or other files for log aggregation, you’ll need a persistent volume.

Errors and Error Messages

The following sections describe common errors that may occur when using the AnyCAGateway REST and steps to help resolve them.

CA Plugin Not Configured

• Description

  Errors occur when attempting to add a certificate authority A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. (CA) or perform CA-related operations. The AnyCAGateway REST portal remains accessible, but log entries indicating plugin configuration issues may be generated.

• Likely Cause

  No third-party CA plugin is configured. The gateway is running with the placeholder CA plugin.

• Resolution

  Install and configure a third-party CA plugin by placing the required plugin files, including the plugin DLL files and manifest.json, are present in the Extensions directory. For more information, see Configure AnyCAGateway REST Plugins.

Example log messages:

Revocation Check Errors when using Client Certificate Authentication

• Description

  Authentication fails when client certificate authentication is used.

• Likely Causes

  • Certificate distribution points (CDPs) are not reachable.

  • CDPs are not configured correctly on the client authentication certificate.

• Resolution

  • Review and correct the CDP configuration for the certificate.

  • If necessary, turn off revocation checking during installation by setting CheckClientCertCRL to False in the appsettings.json file and restarting the gateway service.

OAuth Authentication Failing

• Description

  OAuth authentication attempts fail when accessing the portal or API.

• Resolution

  Review the gateway logs and compare the token claims recorded for each authentication attempt. Identify and correct any discrepancies between expected and actual claims.

CA Not Available for Enrollment

• Description

  A configured CA does not appear as available for enrollment Certificate enrollment refers to the process by which a user requests a digital certificate. The user must submit the request to a certificate authority (CA)..

• Likely Cause

  The CA is not configured for enrollment.

• Resolution

  Ensure that the Use for Enrollment option is turned on for the CA in Keyfactor Command.

Template or Enrollment Pattern Not Available for Enrollment

• Description

  A certificate template A certificate template defines the policies and rules that a CA uses when a request for a certificate is received. or enrollment pattern does not appear as available for enrollment.

• Likely Cause

  Required permissions or roles are not configured.

• Resolution

  In Keyfactor Command:

  • Ensure Use AD Permissions is turned off for the enrollment pattern.

  • Ensure one or more roles are assigned in Associated Roles on the Basic Information tab.

403.16 Error When Using Client Certificate Authentication

• Description

  A 403.16 error occurs during authentication using a client certificate.

• Likely Causes

  • The client certificate chain is not trusted by the gateway server.

  • An intermediate certificate is incorrectly placed in the Trusted Root Certificate Authorities store.

• Resolution

  1. Verify that the client authentication certificate chain is trusted by the AnyCAGateway REST server.
  2. Open the Certificates (Local Computer) MMC on the gateway server.
  3. Navigate to Trusted Root Certificate Authorities.
  4. Identify any certificates where the Issued To value does not match the Issued By value.
  5. Remove any such certificates and retry authentication.

  

  Figure 820: Certificate Incorrectly in the Trusted Root Certificate Store

Services

Open Windows Services on the AnyCAGateway REST and scroll down to locate the Keyfactor AnyCAGateway Servce (Name). The value in parentheses will be (Default) unless you supplied a different value in the -ServiceSuffix parameter (see Install AnyCAGateway REST on Windows under IIS). If the service has not started, start the service.

You can also track the path to the gateway installation on the services properties dialog.

Figure 822: Path to Executable