A certificate request is refused with 400

The management API refuses a request or a revocation order with status 400; no order is created.

Environment

Requests and revocation orders through the management API, from the management application or from a script.

400 means the input isn't valid. The most common reasons:

Reason	Explanation
CSR without proof of possession	TrustBridge accepts only CSRs with proof of possession; for hybrid certificates, for both keys
Name outside the namespace	A partner may only receive names in its own namespace; the name constraint of its issuing CA (`nameConstraints` per RFC 5280) admits no others
Invalid revocation reason	Revocation reasons are the identifiers from RFC 5280 Section 5.3.1, except `removeFromCRL`

The error carries a fixed ID and a message in the caller's language.

Read the error ID and match it to one of the reasons.
Create the CSR with the system's private key so that it carries proof of possession; for hybrid certificates, for both keys.
Use DNS names from your organization's namespace. Another partner's name can't be requested, even with a valid sign-in.
For a revocation order, choose a reason from RFC 5280 Section 5.3.1.

The request is accepted and appears as an order in pending_approval, or, for automatic classes, is issued.