Diagnostic code

ZC-E0810

a certificate is not signed by the pinned anchor

Kind

error

Blame

external

Exit code

3

What it means

The certificate's issuer is not this cluster's CA, or its signature does not verify under the pinned anchor key.

Only certificates signed directly by the one pinned key are accepted: no chain, no intermediate. The check comes before the validity window, so a forged certificate is never reported as expired.

Check that both sides were given the same cluster CA, and that the certificate was issued after the last --new-ca. A certificate issued by an earlier CA must be replaced.

Offline

The same text, without a network:

zcube explain E0810