Troubleshooting

• Confirm the built-in account is scoped to the correct TSG.Verify that the built-in account was created in the TSG where the Signing Keys are configured. A built-in account can only access Signing Keys within its own TSG (and child TSGs, if created on a parent TSG).
• Verify that the host URLs are correct.The client must point to your TSG endpoint. You can confirm the configured URLs by running:

  pkcs11config option show

  If you are using the Windows CSP/KSP client, replace pkcs11config with cspconfig.

  If HSM Server URL and Auth Server URL do not match your TSG endpoint, update them:

  pkcs11config seturls --hostname <tsg-id>.ngts.paloaltonetworks.com

• Verify that the built-in account Client ID is correct.You can view the Client ID by running:

  pkcs11config option show

  The Client ID will be shown as the Client ID value. Compare it to what you see in the Built-in Accounts inventory at System Settings > Built-in Accounts, and update as necessary with pkcs11config login.