--- title: "Error \"Could not get pending signature\"" description: "Diagnosing the Could not get pending signature error in web remote signatures with Rest PKI and Web PKI, common with on-premises instances." canonical: "https://docs.lacunasoftware.com/en-us/articles/rest-pki/troubleshoot/could-not-get-pending-sig" locale: "en" product: "Rest PKI (legacy)" last_updated: "2026-10-12" --- # Error "Could not get pending signature" When implementing a page with [web remote signatures](https://docs.lacunasoftware.com/en-us/articles/pki-guide/web-signatures/remote) using [Rest PKI](https://docs.lacunasoftware.com/en-us/articles/rest-pki) together with [Web PKI](https://docs.lacunasoftware.com/en-us/articles/web-pki), the following error may occur on the end user's browser: > Could not get pending signature In the remote signature samples that use Web PKI's `signWithRestPki` function, Web PKI and Rest PKI communicate directly to exchange the signature data. This error means that this communication is not working properly. The problem is common when using your own instance of Rest PKI (*on premises*), but it may also happen with the Rest PKI cloud (at https://pki.rest/). The first step to diagnose the problem is to check whether the user's computer can access the Rest PKI instance being used. Open a browser on the user's computer and access: * Rest PKI cloud: https://restpki.lacunasoftware.com/Api/System/Info * Rest PKI *on premises*: https://restpki.yourcompany.com/Api/System/Info (replace with the URL of your instance) > **Note** > > Although the default URL to access the Rest PKI APIs is `https://pki.rest/`, Web PKI uses by default the alternative URL > `https://restpki.lacunasoftware.com/` which, being more conventional, is less likely to be blocked by the firewalls of > end users' networks. The expected result is an XML similar to the following: ```xml Lacuna Rest PKI 1.13.1 ``` If the call fails, the error shown should help diagnose the problem. * For the Rest PKI cloud, the call was probably blocked by the firewall of the user's network. Ask whoever manages the network to allow the `restpki.lacunasoftware.com` domain over HTTPS. * For Rest PKI *on premises*, the main reasons for failure are: * Your Rest PKI instance is not publicly available * Your Rest PKI instance is publicly available, but it is being blocked by a firewall in the end user's environment. In that case, to avoid possible blocks, make sure that your Rest PKI URL: * Uses a hostname, not an IP address (e.g. `http://201.184.43.191/`) * Uses HTTPS with a valid SSL certificate * Uses a standard port (443 or, if not on HTTPS, port 80) If the call succeeds, returning an XML similar to the one shown above, perform the procedure described in the section below on the computer where the error occurs. ## Debugging the extension on Chrome > **Note** > > If the problem only happens on browsers other than Chrome, see the instructions at the end of the article 1. Right-click the Web PKI icon (yellow chip) on the top right corner of the browser and click the **Manage extensions** option 1. Check the **Developer mode** box at the top of the extension list 1. Find Web PKI on the extension list and click the **background page** link 1. On the window that opens, click the **Network** tab 1. Repeat the signature procedure on the browser 1. The failed network call to Rest PKI is recorded on the Network tab. Click the call. After this procedure, you should see a screen similar to the following: ![Web PKI network error](https://docs.lacunasoftware.com/images/rest-pki/web-pki-network-error.png) The error details of the network call to Rest PKI should point to the cause of the problem: * If you are using your own instance of Rest PKI ... * ... and the call was made to the **`restpki.lacunasoftware.com` domain instead of the domain of your Rest PKI instance**: the Rest PKI address is not configured correctly in the page's Javascript code. See the solution in the article [Custom RestPKI configuration](https://docs.lacunasoftware.com/en-us/articles/web-pki/customizing-restpki-url). * ... and the call was made to the correct domain of your Rest PKI instance ... * ... and failed with **status code 404**: the Rest PKI address may not be configured correctly in your backend code. Check the initialization of the `RestPkiClient` class (the class name may be slightly different depending on the programming language). * ... and failed with **another status code**: try to diagnose the problem from the error code and message. **NOTE:** invalid SSL certificates cause the communication between Web PKI and Rest PKI to fail silently. The SSL certificate in use must be within its validity period and must have been issued by a Certification Authority trusted by default by the operating systems. * If you are using the default Rest PKI instance at `https://pki.rest/`: check the error code. Access to Rest PKI is probably being blocked by the firewall of the user's network. If so, contact whoever manages that network. ## Debugging the extension on Firefox To diagnose communication failures between Web PKI and Rest PKI on Firefox, follow the steps below: 1. Open the Firefox menu (icon on the top right corner) 1. Click **Add-ons** 1. Click the gear at the top of the page, then **Debug Add-ons** 1. Check the **Enable add-on debugging** box 1. Find Web PKI on the extension list and click the **Debug** link 1. On the pop-up that appears, click **Allow** 1. On the window that opens, click the **Network** tab 1. Repeat the signature process on the browser 1. The failed network call to Rest PKI is recorded on the Network tab. Click the call. > **Note** > > On Firefox, the *Network* tab of the extension's debug window shows the calls made by the page mixed with the calls made by the extension. To > help, the call Web PKI makes to Rest PKI can be identified by its route, called **Certificate**