diff --git a/support/iam/src/basic/serv/iam_cert_serv.rs b/support/iam/src/basic/serv/iam_cert_serv.rs
index 695e835ca..e2cfed8bf 100644
--- a/support/iam/src/basic/serv/iam_cert_serv.rs
+++ b/support/iam/src/basic/serv/iam_cert_serv.rs
@@ -212,7 +212,8 @@ impl IamCertServ {
     }
 
     pub async fn get_kernel_cert(account_id: &str, rel_iam_cert_kind: &IamCertKernelKind, funs: &TardisFunsInst, ctx: &TardisContext) -> TardisResult<RbumCertSummaryWithSkResp> {
-        let rel_rbum_cert_conf_id = Self::get_cert_conf_id_by_kind(rel_iam_cert_kind.to_string().as_str(), rbum_scope_helper::get_max_level_id_by_context(ctx), funs).await?;
+        let ctx = IamAccountServ::new_context_if_account_is_global(ctx, funs).await?;
+        let rel_rbum_cert_conf_id = Self::get_cert_conf_id_by_kind(rel_iam_cert_kind.to_string().as_str(), Some(ctx.clone().own_paths), funs).await?;
         let kernel_cert = RbumCertServ::find_one_detail_rbum(
             &RbumCertFilterReq {
                 rel_rbum_id: Some(account_id.to_string()),
@@ -220,11 +221,11 @@ impl IamCertServ {
                 ..Default::default()
             },
             funs,
-            ctx,
+            &ctx,
         )
         .await?;
         if let Some(kernel_cert) = kernel_cert {
-            let now_sk = RbumCertServ::show_sk(kernel_cert.id.as_str(), &RbumCertFilterReq::default(), funs, ctx).await?;
+            let now_sk = RbumCertServ::show_sk(kernel_cert.id.as_str(), &RbumCertFilterReq::default(), funs, &ctx).await?;
             Ok(RbumCertSummaryWithSkResp {
                 id: kernel_cert.id,
                 ak: kernel_cert.ak,
diff --git a/support/iam/src/iam_initializer.rs b/support/iam/src/iam_initializer.rs
index 3532fa8cb..67dfe662c 100644
--- a/support/iam/src/iam_initializer.rs
+++ b/support/iam/src/iam_initializer.rs
@@ -194,7 +194,7 @@ async fn init_basic_info<'a>(funs: &TardisFunsInst, ctx: &TardisContext) -> Tard
         .iter()
         .find(|r| r.code == iam_constants::RBUM_ITEM_NAME_TENANT_AUDIT_ROLE)
         .map(|r| r.id.clone())
-        .ok_or_else(|| funs.err().not_found("iam", "init", "not found audit admin role", ""))?;
+        .ok_or_else(|| funs.err().not_found("iam", "init", "not found tenant audit admin role", ""))?;
 
     let role_app_admin_id = roles
         .iter()