VERIFY_ERROR_CODES

VERIFY_ERROR_CODES

Discriminant for every failure a verify operation can produce.

• no_trusted_root — chain could not be anchored to any root or TrustAnchor.
• issuer_not_found — an intermediate's issuer was not in the candidate set, or its issuer DN does not match the candidate issuer's subject DN.
• signature_invalid — a certificate's signature failed cryptographic verification.
• certificate_expired — a certificate's notBefore/notAfter window excludes the validation time.
• ca_required — an issuer lacks basicConstraints.ca = true.
• key_cert_sign_required — an issuer has keyUsage but omits keyCertSign.
• path_length_exceeded — the number of CA certificates below an issuer exceeds its pathLength.
• path_building_limit_exceeded — candidate-path construction exceeded its bounded work limits.
• authority_key_identifier_mismatch — a certificate's AKI does not match the issuer's SKI.
• extended_key_usage_invalid — the leaf certificate lacks the required EKU for the requested purpose.
• subject_alt_name_mismatch — no SAN entry matches the requested service identity.
• common_name_fallback_suppressed — CN fallback was attempted but suppressed (SAN present or disabled).
• self_signed_leaf_not_allowed — the leaf is self-signed and allowSelfSignedLeaf was not set.
• unrecognized_critical_extension — a certificate contains a critical extension the verifier cannot process.
• no_rev_avail_conflict — a certificate carries noRevAvail alongside a CA basicConstraints, cRLDistributionPoints, freshestCRL, or an id-ad-ocsp authorityInfoAccess entry (RFC 9608 §3).
• display_text_oversized — under rejectOversizedDisplayText, a certificate's user notice explicitText or noticeRef organization exceeds the 200 characters of RFC 5280 §4.2.1.4.
• intermediate_eku_constraint — an intermediate CA's EKU set does not include the required purpose.
• explicit_policy_required — requireExplicitPolicy was set but no acceptable policy was found.
• initial_policy_set_not_satisfied — the chain's policies do not intersect initialPolicySet.
• unsupported_initial_name_constraints — caller-supplied initial name constraints use unsupported or malformed forms.
• unsupported_name_constraints — a certificate's nameConstraints use an unsupported form.
• name_constraints_violated — a subject name violates a permitted/excluded subtree.
• unsupported_signature_algorithm_parameters — the signature algorithm uses unrecognized parameters.
• ec_domain_parameters_missing — an elliptic curve public key carries no namedCurve domain parameters.
• public_key_distrusted — a certificate or bare trust anchor uses an explicitly distrusted SHA-256 SPKI.
• certificate_revoked — revocation evidence confirms a chain certificate is revoked.
• revocation_indeterminate — revocation status could not be determined under a hard-fail policy.
• unsupported — a certificate source holds a construct micro509 does not decode (see ParseCertificateErrorCode).
• limit_exceeded — a certificate source exceeds a micro509 decoding limit (see ParseCertificateErrorCode).

const VERIFY_ERROR_CODES: "no_trusted_root" | "issuer_not_found" | "signature_invalid" | "certificate_expired" | "ca_required" | "key_cert_sign_required" | "path_length_exceeded" | "path_building_limit_exceeded" | "authority_key_identifier_mismatch" | "extended_key_usage_invalid" | "subject_alt_name_mismatch" | "common_name_fallback_suppressed" | "self_signed_leaf_not_allowed" | "unrecognized_critical_extension" | "no_rev_avail_conflict" | "display_text_oversized" | "intermediate_eku_constraint" | "explicit_policy_required" | "initial_policy_set_not_satisfied" | "unsupported_initial_name_constraints" | "unsupported_name_constraints" | "name_constraints_violated" | "unsupported_signature_algorithm_parameters" | "ec_domain_parameters_missing" | "public_key_distrusted" | "certificate_revoked" | "revocation_indeterminate" | "unsupported" | "limit_exceeded"[]