Usable X.509 errors: Botan

(No detailed documentation provided by the library.)

Original error message:

Certificate is not yet valid (source)

Example certificates

Below you can download one or more example malformed certificates causing CERT_­NOT_­YET_­VALID in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  NOT_YET_VALID (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing CERT_­NOT_­YET_­VALID in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CERT_­NOT_­YET_­VALID
• GnuTLS: GNUTLS_­CERT_­NOT_­ACTIVATED
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­FUTURE
• OpenJDK: PKIX_­PATH_­VALIDATION_­FAILED, VALIDITY_­CHECK_­FAILED

(No detailed documentation provided by the library.)

Original error message:

Certificate has expired (source)

Example certificates

Below you can download one or more example malformed certificates causing CERT_­HAS_­EXPIRED in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  EXPIRED (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing CERT_­HAS_­EXPIRED in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CERT_­HAS_­EXPIRED
• GnuTLS: GNUTLS_­CERT_­EXPIRED
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­EXPIRED
• OpenJDK: PKIX_­PATH_­VALIDATION_­FAILED, VALIDITY_­CHECK_­FAILED

(No detailed documentation provided by the library.)

Original error message:

CRL response is not yet valid (source)

(No detailed documentation provided by the library.)

Original error message:

CRL has expired (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP is not yet valid (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP response has expired (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP response is too old (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate is revoked (source)

(No detailed documentation provided by the library.)

Original error message:

Cannot establish trust (source)

Example certificates

Below you can download one or more example malformed certificates causing CANNOT_­ESTABLISH_­TRUST in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  SELF_SIGNED_END_ENTITY (see the  generation script)
• Case  SELF_SIGNED_INTERMEDIATE (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing CANNOT_­ESTABLISH_­TRUST in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY, X509_­V_­ERR_­SELF_­SIGNED_­CERT_­IN_­CHAIN
• GnuTLS: GNUTLS_­CERT_­SIGNER_­NOT_­FOUND
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED
• OpenJDK: UNABLE_­TO_­FIND_­VALID_­CERTIFICATION_­PATH

(No detailed documentation provided by the library.)

Original error message:

Certificate chain does not end in a CA certificate (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate public key invalid, no HTTP support compiled in (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate issuer not found (source)

Example certificates

Below you can download one or more example malformed certificates causing CERT_­ISSUER_­NOT_­FOUND in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  CHAIN_LOOP (see the  generation script)
• Case  ISSUER_NO_MATCH_SUBJECT (see the  generation script)
• Case  TRUSTED_ONLY_INTERMEDIATE (see the  generation script)
• Case  UNKNOWN_ROOT_CN (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing CERT_­ISSUER_­NOT_­FOUND in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY, X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT
• GnuTLS: GNUTLS_­CERT_­SIGNER_­NOT_­FOUND, GNUTLS_­E_­KEY_­USAGE_­VIOLATION, GNUTLS_­E_­SUCCESS
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­KEY_­USAGE, MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED, MBEDTLS_­OK
• OpenJDK: UNABLE_­TO_­FIND_­VALID_­CERTIFICATION_­PATH, NO_­MESSAGE

(No detailed documentation provided by the library.)

Original error message:

Loop in certificate chain (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate chain too long (source)

Example certificates

Below you can download one or more example malformed certificates causing CERT_­CHAIN_­TOO_­LONG in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  BC_PATH_LEN_EXCEEDED (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing CERT_­CHAIN_­TOO_­LONG in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­PATH_­LENGTH_­EXCEEDED
• GnuTLS: GNUTLS_­CERT_­SIGNER_­CONSTRAINTS_­FAILURE
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED
• OpenJDK: PKIX_­PATH_­VALIDATION_­FAILED, PATH_­LEN_­CONSTRAINT_­VIOLATED

(No detailed documentation provided by the library.)

Original error message:

Unable to find certificate issusing OCSP response (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP signature error (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP bad status (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP parsing valid (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP URL not available (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP server not available (source)

(No detailed documentation provided by the library.)

Original error message:

No revocation data (source)

(No detailed documentation provided by the library.)

Original error message:

Unknown critical extension encountered (source)

Example certificates

Below you can download one or more example malformed certificates causing UNKNOWN_­CRITICAL_­EXTENSION in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  BC_PATH_LEN_NEGATIVE (see the  generation script)
• Case  EMPTY_IP_ADDR_BLOCKS (see the  generation script)
• Case  IP_ADDR_BLOCKS_NO_SUBSET (see the  generation script)
• Case  NC_MINIMUM_NOT_ZERO (see the  generation script)
• Case  NC_UNKNOWN_NAME_TYPE (see the  generation script)
• Case  PROXY_CA (see the  generation script)
• Case  PROXY_LENGTH_EXCEEDED (see the  generation script)
• Case  PROXY_NAME_NO_MATCH_ISSUER (see the  generation script)
• Case  PROXY_WITH_SAN (see the  generation script)
• Case  UNKNOWN_CRITICAL_EXTENSION (see the  generation script)
• Case  VALID_PROXY (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing UNKNOWN_­CRITICAL_­EXTENSION in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY, X509_­V_­ERR_­INVALID_­EXTENSION, X509_­V_­ERR_­UNNESTED_­RESOURCE, X509_­V_­ERR_­SUBTREE_­MINMAX, X509_­V_­ERR_­UNSUPPORTED_­CONSTRAINT_­TYPE, X509_­V_­ERR_­PROXY_­PATH_­LENGTH_­EXCEEDED, X509_­V_­ERR_­PROXY_­SUBJECT_­NAME_­VIOLATION, X509_­V_­ERR_­UNHANDLED_­CRITICAL_­EXTENSION, X509_­V_­OK
• GnuTLS: GNUTLS_­E_­SUCCESS, GNUTLS_­CERT_­UNKNOWN_­CRIT_­EXTENSIONS, GNUTLS_­CERT_­SIGNER_­CONSTRAINTS_­FAILURE, GNUTLS_­CERT_­UNEXPECTED_­OWNER, GNUTLS_­CERT_­SIGNER_­NOT_­CA
• Mbed TLS: MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS
• OpenJDK: NO_­MESSAGE, PKIX_­PATH_­VALIDATION_­FAILED, UNRECOGNIZED_­CRITICAL_­EXTENSION, MINIMUM_­NAME_­CONSTRAINTS, UNSUPPORTED_­HANDSHAKE_­MESSAGE, CA_­KEY_­USAGE_­FAILED

(No detailed documentation provided by the library.)

Original error message:

CA certificate not allowed to issue certs (source)

Example certificates

Below you can download one or more example malformed certificates causing CA_­CERT_­NOT_­FOR_­CERT_­ISSUER in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  ISSUER_CA_FALSE (see the  generation script)
• Case  NO_CERTSIGN_IN_KEYUSAGE (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing CA_­CERT_­NOT_­FOR_­CERT_­ISSUER in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­INVALID_­CA, X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY
• GnuTLS: GNUTLS_­CERT_­SIGNER_­NOT_­CA, GNUTLS_­CERT_­SIGNER_­CONSTRAINTS_­FAILURE
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED
• OpenJDK: PKIX_­PATH_­VALIDATION_­FAILED, NOT_­A_­CA_­CERTIFICATE, CA_­KEY_­USAGE_­FAILED

(No detailed documentation provided by the library.)

Original error message:

Duplicate certificate extension encountered (source)

Example certificates

Below you can download one or more example malformed certificates causing DUPLICATE_­CERT_­EXTENSION in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  DUPLICATE_BC_EXTENSION (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing DUPLICATE_­CERT_­EXTENSION in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY
• GnuTLS: GNUTLS_­E_­X509_­DUPLICATE_­EXTENSION
• Mbed TLS: MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS
• OpenJDK: FAILED_­TO_­PARSE_­SERVER_­CERTIFICATES

(No detailed documentation provided by the library.)

Original error message:

Encountered extension in certificate with version < 3 (source)

Example certificates

Below you can download one or more example malformed certificates causing EXT_­IN_­V1_­V2_­CERT in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  V1_CERT_WITH_EXTENSIONS (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing EXT_­IN_­V1_­V2_­CERT in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­OK
• GnuTLS: GNUTLS_­E_­CERTIFICATE_­ERROR
• Mbed TLS: MBEDTLS_­ERR_­X509_­INVALID_­FORMAT
• OpenJDK: FAILED_­TO_­PARSE_­SERVER_­CERTIFICATES

(No detailed documentation provided by the library.)

Original error message:

Certificate does not match provided name (source)

Example certificates

Below you can download one or more example malformed certificates causing CERT_­NAME_­NOMATCH in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  EMPTY_SUBJECT_AND_NO_SAN (see the  generation script)
• Case  HOST_NO_MATCH_CN (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing CERT_­NAME_­NOMATCH in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­HOSTNAME_­MISMATCH
• GnuTLS: GNUTLS_­CERT_­UNEXPECTED_­OWNER
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­CN_­MISMATCH
• OpenJDK: FAILED_­TO_­PARSE_­SERVER_­CERTIFICATES, NO_­NAME_­MATCHING

(No detailed documentation provided by the library.)

Original error message:

Certificate issuer does not match subject of issuing cert (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate does not pass name constraint (source)

Example certificates

Below you can download one or more example malformed certificates causing NAME_­CONSTRAINT_­ERROR in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  NC_MAXIMUM_PRESENT (see the  generation script)
• Case  NC_PERMITTED_VIOLATION (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing NAME_­CONSTRAINT_­ERROR in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­SUBTREE_­MINMAX, X509_­V_­ERR_­PERMITTED_­VIOLATION
• GnuTLS: GNUTLS_­CERT_­SIGNER_­CONSTRAINTS_­FAILURE, GNUTLS_­CERT_­UNEXPECTED_­OWNER
• Mbed TLS: MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS
• OpenJDK: PKIX_­PATH_­VALIDATION_­FAILED, MAXIMUM_­NAME_­CONSTRAINTS, NAME_­CONSTRAINTS_­CHECK_­FAILED

(No detailed documentation provided by the library.)

Original error message:

Distinguished name too long (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate does not allow the requested usage (source)

Example certificates

Below you can download one or more example malformed certificates causing INVALID_­USAGE in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  ANY_EXT_KEY_USAGE (see the  generation script)
• Case  UNKNOWN_EXT_KEY_USAGE (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing INVALID_­USAGE in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­INVALID_­PURPOSE
• GnuTLS: GNUTLS_­E_­SUCCESS, GNUTLS_­CERT_­UNEXPECTED_­OWNER
• Mbed TLS: MBEDTLS_­OK, MBEDTLS_­X509_­BADCERT_­EXT_­KEY_­USAGE
• OpenJDK: NO_­MESSAGE, EXT_­KEY_­USAGE_­NO_­TLS_­SERVER

(No detailed documentation provided by the library.)

Original error message:

Certificate policy error (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate contains duplicate policy (source)

(No detailed documentation provided by the library.)

Original error message:

CA certificate not allowed to issue CRLs (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP issuer's keyusage prohibits OCSP (source)

(No detailed documentation provided by the library.)

Original error message:

Signature method too weak (source)

Example certificates

Below you can download one or more example malformed certificates causing SIGNATURE_­METHOD_­TOO_­WEAK in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  ISSUER_RSA_KEY_1024 (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing SIGNATURE_­METHOD_­TOO_­WEAK in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CA_­KEY_­TOO_­SMALL
• GnuTLS: GNUTLS_­CERT_­INSECURE_­ALGORITHM
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­BAD_­KEY
• OpenJDK: NO_­MESSAGE

(No detailed documentation provided by the library.)

Original error message:

Certificate signed with unknown/unavailable algorithm (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate signature has invalid parameters (source)

(No detailed documentation provided by the library.)

Original error message:

Hash function used is considered too weak for security (source)

Example certificates

Below you can download one or more example malformed certificates causing UNTRUSTED_­HASH in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  ISSUER_HASH_MD5 (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing UNTRUSTED_­HASH in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CA_­MD_­TOO_­WEAK
• GnuTLS: GNUTLS_­CERT_­INSECURE_­ALGORITHM
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­BAD_­MD
• OpenJDK: PKIX_­PATH_­VALIDATION_­FAILED, FAILED_­SIGNATURE_­ALGORITHM

(No detailed documentation provided by the library.)

Original error message:

Signature error (source)

Example certificates

Below you can download one or more example malformed certificates causing SIGNATURE_­ERROR in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  INVALID_SIGNATURE (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing SIGNATURE_­ERROR in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CERT_­SIGNATURE_­FAILURE
• GnuTLS: GNUTLS_­CERT_­SIGNATURE_­FAILURE
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED
• OpenJDK: PKIX_­PATH_­VALIDATION_­FAILED, SIGNATURE_­CHECK_­FAILED

(No detailed documentation provided by the library.)

Original error message:

CRL bad signature (source)

(No detailed documentation provided by the library.)

Original error message:

Botan::Decoding_error (source)

Example certificates

Below you can download one or more example malformed certificates causing DECODING_­ERROR in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  PUBKEY_INFO_INVALID_OID (see the  generation script)
• Case  V4_CERT (see the  generation script)
• Case  WRONG_SIGNATURE_ALGORITHM (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing DECODING_­ERROR in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­EE_­KEY_­TOO_­SMALL, X509_­V_­OK, X509_­V_­ERR_­CERT_­SIGNATURE_­FAILURE
• GnuTLS: GNUTLS_­E_­CERTIFICATE_­ERROR, GNUTLS_­E_­SUCCESS
• Mbed TLS: MBEDTLS_­ERR_­X509_­SIG_­MISMATCH
• OpenJDK: UNSUPPORTED_­SIGNATURE_­ALGORITHM, FAILED_­TO_­PARSE_­SERVER_­CERTIFICATES

(No detailed documentation provided by the library.)

Original error message:

Certificate serial number is negative (source)

(No detailed documentation provided by the library.)

Original error message:

Botan::Invalid_Argument (source)

(No detailed documentation provided by the library.)

Original error message:

Botan::Encoding_Error (source)

Example certificates

Below you can download one or more example malformed certificates causing ENCODING_­ERROR in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  NC_EMPTY (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing ENCODING_­ERROR in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­OK
• GnuTLS: GNUTLS_­CERT_­UNEXPECTED_­OWNER
• Mbed TLS: MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS
• OpenJDK: NO_­MESSAGE

(No detailed documentation provided by the library.)

Original error message:

No CRL with matching distribution point for certificate (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP cert not listed (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP requests not available (source)

(No detailed documentation provided by the library.)

Original error message:

Signature on OCSP response was found valid (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP response accepted as affirming unrevoked status for certificate (source)

(No detailed documentation provided by the library.)

Original error message:

Valid CRL examined (source)

(No detailed documentation provided by the library.)

Original error message:

Verified (source)

Example certificates

Below you can download one or more example malformed certificates causing VERIFIED in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  BC_NOT_CRITICAL_CA (see the  generation script)
• Case  BC_PATH_LEN_IN_NON_CA (see the  generation script)
• Case  EMPTY_EXT_KEY_USAGE (see the  generation script)
• Case  EMPTY_KEY_USAGE_END_CERT (see the  generation script)
• Case  NC_EXCLUDED_VIOLATION (see the  generation script)
• Case  NEGATIVE_SERIAL_NUMBER (see the  generation script)
• Case  NO_KEY_USAGE_IN_CA (see the  generation script)
• Case  SAN_EMPTY_EMAIL (see the  generation script)
• Case  SAN_NULL_BYTE_IN_EMAIL (see the  generation script)
• Case  SIGNATURE_ALGORITHM_MISMATCH (see the  generation script)
• Case  VALID (see the  generation script)
• Case  VALID_WITH_AIA (see the  generation script)
• Case  VALID_WITH_CRLDP (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing VERIFIED in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­OK, X509_­V_­ERR_­INVALID_­PURPOSE, X509_­V_­ERR_­EXCLUDED_­VIOLATION, X509_­V_­ERR_­UNSUPPORTED_­NAME_­SYNTAX, X509_­V_­ERR_­CA_­KEY_­TOO_­SMALL
• GnuTLS: GNUTLS_­E_­SUCCESS, GNUTLS_­CERT_­SIGNER_­CONSTRAINTS_­FAILURE, GNUTLS_­CERT_­UNEXPECTED_­OWNER, GNUTLS_­E_­CERTIFICATE_­ERROR
• Mbed TLS: MBEDTLS_­OK, MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS, MBEDTLS_­X509_­BADCERT_­KEY_­USAGE
• OpenJDK: NO_­MESSAGE, EXT_­KEY_­USAGE_­NO_­TLS_­SERVER, PKIX_­PATH_­VALIDATION_­FAILED, INCORRECT_­KEY_­USAGE_­BITS, FAILED_­TO_­PARSE_­SERVER_­CERTIFICATES, SIGNATURE_­CHECK_­FAILED

(No detailed documentation provided by the library.)

Original error message:

Botan::TLS_Exception (source)

Example certificates

Below you can download one or more example malformed certificates causing TLS_­EXCEPTION in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  END_ENTITY_RSA_KEY_1024 (see the  generation script)
• Case  ISSUER_PUBKEY_INFO_INVALID_OID (see the  generation script)
• Case  ISSUER_PUBKEY_INVALID_OID_AND_SIGNATURE (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing TLS_­EXCEPTION in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­EE_­KEY_­TOO_­SMALL, X509_­V_­ERR_­CA_­KEY_­TOO_­SMALL
• GnuTLS: GNUTLS_­CERT_­INSECURE_­ALGORITHM, GNUTLS_­E_­CERTIFICATE_­ERROR
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­BAD_­KEY
• OpenJDK: NO_­MESSAGE, PKIX_­PATH_­VALIDATION_­FAILED, SIGNATURE_­CHECK_­FAILED