Botan: X.509 errors

(No detailed documentation provided by the library.)

Original error message:

Certificate is not yet valid (source)

Example certificates

Below you can download one or more example malformed certificates causing CERT_­NOT_­YET_­VALID in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  not-yet-valid (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing CERT_­NOT_­YET_­VALID in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CERT_­NOT_­YET_­VALID
• GnuTLS: GNUTLS_­CERT_­NOT_­ACTIVATED
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­FUTURE

(No detailed documentation provided by the library.)

Original error message:

Certificate has expired (source)

Example certificates

Below you can download one or more example malformed certificates causing CERT_­HAS_­EXPIRED in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  expired (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing CERT_­HAS_­EXPIRED in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CERT_­HAS_­EXPIRED
• GnuTLS: GNUTLS_­CERT_­EXPIRED
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­EXPIRED

(No detailed documentation provided by the library.)

Original error message:

CRL response is not yet valid (source)

(No detailed documentation provided by the library.)

Original error message:

CRL has expired (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP is not yet valid (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP response has expired (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP response is too old (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate is revoked (source)

(No detailed documentation provided by the library.)

Original error message:

Cannot establish trust (source)

Example certificates

Below you can download one or more example malformed certificates causing CANNOT_­ESTABLISH_­TRUST in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  self-signed-end-entity (see the  generation script)
• Case  self-signed-intermediate (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing CANNOT_­ESTABLISH_­TRUST in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• GnuTLS: GNUTLS_­CERT_­SIGNER_­NOT_­FOUND
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED

(No detailed documentation provided by the library.)

Original error message:

Certificate chain does not end in a CA certificate (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate public key invalid, no HTTP support compiled in (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate issuer not found (source)

Example certificates

Below you can download one or more example malformed certificates causing CERT_­ISSUER_­NOT_­FOUND in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  issuer-no-match-subject (see the  generation script)
• Case  trusted-only-intermediate (see the  generation script)
• Case  unknown-root-cn (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing CERT_­ISSUER_­NOT_­FOUND in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY, X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT
• GnuTLS: GNUTLS_­CERT_­SIGNER_­NOT_­FOUND, GNUTLS_­E_­SUCCESS
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED, MBEDTLS_­OK

(No detailed documentation provided by the library.)

Original error message:

Loop in certificate chain (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate chain too long (source)

Example certificates

Below you can download one or more example malformed certificates causing CERT_­CHAIN_­TOO_­LONG in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  bc-path-len-exceeded (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing CERT_­CHAIN_­TOO_­LONG in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­PATH_­LENGTH_­EXCEEDED
• GnuTLS: GNUTLS_­CERT_­SIGNER_­CONSTRAINTS_­FAILURE
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED

(No detailed documentation provided by the library.)

Original error message:

Unable to find certificate issusing OCSP response (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP signature error (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP bad status (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP parsing valid (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP URL not available (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP server not available (source)

(No detailed documentation provided by the library.)

Original error message:

No revocation data (source)

(No detailed documentation provided by the library.)

Original error message:

Unknown critical extension encountered (source)

Example certificates

Below you can download one or more example malformed certificates causing UNKNOWN_­CRITICAL_­EXTENSION in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  bc-path-len-negative (see the  generation script)
• Case  empty-ip-addr-blocks (see the  generation script)
• Case  ip-addr-blocks-no-subset (see the  generation script)
• Case  nc-minimum-not-zero (see the  generation script)
• Case  nc-unknown-name-type (see the  generation script)
• Case  proxy-ca (see the  generation script)
• Case  proxy-length-exceeded (see the  generation script)
• Case  proxy-name-no-match-issuer (see the  generation script)
• Case  proxy-with-san (see the  generation script)
• Case  unknown-critical-extension (see the  generation script)
• Case  valid-proxy (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing UNKNOWN_­CRITICAL_­EXTENSION in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY, X509_­V_­ERR_­INVALID_­EXTENSION, X509_­V_­ERR_­UNNESTED_­RESOURCE, X509_­V_­ERR_­SUBTREE_­MINMAX, X509_­V_­ERR_­INVALID_­NON_­CA, X509_­V_­ERR_­PROXY_­PATH_­LENGTH_­EXCEEDED, X509_­V_­ERR_­PROXY_­SUBJECT_­NAME_­VIOLATION, X509_­V_­ERR_­UNHANDLED_­CRITICAL_­EXTENSION, X509_­V_­OK
• GnuTLS: GNUTLS_­E_­SUCCESS, GNUTLS_­CERT_­UNKNOWN_­CRIT_­EXTENSIONS, GNUTLS_­CERT_­SIGNER_­CONSTRAINTS_­FAILURE, GNUTLS_­CERT_­UNEXPECTED_­OWNER, GNUTLS_­CERT_­SIGNER_­NOT_­CA
• Mbed TLS: MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS

(No detailed documentation provided by the library.)

Original error message:

CA certificate not allowed to issue certs (source)

Example certificates

Below you can download one or more example malformed certificates causing CA_­CERT_­NOT_­FOR_­CERT_­ISSUER in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  issuer-ca-false (see the  generation script)
• Case  no-certsign-in-keyusage (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing CA_­CERT_­NOT_­FOR_­CERT_­ISSUER in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­INVALID_­CA
• GnuTLS: GNUTLS_­CERT_­SIGNER_­NOT_­CA, GNUTLS_­CERT_­SIGNER_­CONSTRAINTS_­FAILURE
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED

(No detailed documentation provided by the library.)

Original error message:

Duplicate certificate extension encountered (source)

Example certificates

Below you can download one or more example malformed certificates causing DUPLICATE_­CERT_­EXTENSION in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  duplicate-bc-extension (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing DUPLICATE_­CERT_­EXTENSION in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY
• GnuTLS: GNUTLS_­E_­CERTIFICATE_­ERROR
• Mbed TLS: MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS

(No detailed documentation provided by the library.)

Original error message:

Encountered extension in certificate with version < 3 (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate does not match provided name (source)

Example certificates

Below you can download one or more example malformed certificates causing CERT_­NAME_­NOMATCH in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  empty-subject-and-no-san (see the  generation script)
• Case  host-no-match-cn (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing CERT_­NAME_­NOMATCH in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• GnuTLS: GNUTLS_­CERT_­UNEXPECTED_­OWNER
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­CN_­MISMATCH

(No detailed documentation provided by the library.)

Original error message:

Certificate issuer does not match subject of issuing cert (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate does not pass name constraint (source)

Example certificates

Below you can download one or more example malformed certificates causing NAME_­CONSTRAINT_­ERROR in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  nc-maximum-present (see the  generation script)
• Case  nc-permitted-violation (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing NAME_­CONSTRAINT_­ERROR in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­SUBTREE_­MINMAX, X509_­V_­ERR_­PERMITTED_­VIOLATION
• GnuTLS: GNUTLS_­CERT_­SIGNER_­CONSTRAINTS_­FAILURE, GNUTLS_­CERT_­UNEXPECTED_­OWNER
• Mbed TLS: MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS

(No detailed documentation provided by the library.)

Original error message:

Distinguished name too long (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate does not allow the requested usage (source)

Example certificates

Below you can download one or more example malformed certificates causing INVALID_­USAGE in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  any-ext-key-usage (see the  generation script)
• Case  unknown-ext-key-usage (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing INVALID_­USAGE in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• GnuTLS: GNUTLS_­E_­SUCCESS, GNUTLS_­CERT_­UNEXPECTED_­OWNER
• Mbed TLS: MBEDTLS_­OK, MBEDTLS_­X509_­BADCERT_­EXT_­KEY_­USAGE

(No detailed documentation provided by the library.)

Original error message:

Certificate policy error (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate contains duplicate policy (source)

(No detailed documentation provided by the library.)

Original error message:

CA certificate not allowed to issue CRLs (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP issuer's keyusage prohibits OCSP (source)

(No detailed documentation provided by the library.)

Original error message:

Signature method too weak (source)

Example certificates

Below you can download one or more example malformed certificates causing SIGNATURE_­METHOD_­TOO_­WEAK in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  issuer-rsa-key-1024 (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing SIGNATURE_­METHOD_­TOO_­WEAK in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CA_­KEY_­TOO_­SMALL
• GnuTLS: GNUTLS_­CERT_­INSECURE_­ALGORITHM
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­BAD_­KEY

(No detailed documentation provided by the library.)

Original error message:

Certificate signed with unknown/unavailable algorithm (source)

(No detailed documentation provided by the library.)

Original error message:

Certificate signature has invalid parameters (source)

(No detailed documentation provided by the library.)

Original error message:

Hash function used is considered too weak for security (source)

Example certificates

Below you can download one or more example malformed certificates causing UNTRUSTED_­HASH in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  issuer-hash-md5 (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing UNTRUSTED_­HASH in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CA_­MD_­TOO_­WEAK
• GnuTLS: GNUTLS_­CERT_­INSECURE_­ALGORITHM
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­BAD_­MD

(No detailed documentation provided by the library.)

Original error message:

Signature error (source)

Example certificates

Below you can download one or more example malformed certificates causing SIGNATURE_­ERROR in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  invalid-signature (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing SIGNATURE_­ERROR in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CERT_­SIGNATURE_­FAILURE
• GnuTLS: GNUTLS_­CERT_­SIGNATURE_­FAILURE
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED

(No detailed documentation provided by the library.)

Original error message:

CRL bad signature (source)

(No detailed documentation provided by the library.)

Original error message:

Botan::Decoding_error (source)

Example certificates

Below you can download one or more example malformed certificates causing DECODING_­ERROR in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  pubkey-info-invalid-oid (see the  generation script)
• Case  v4-cert (see the  generation script)
• Case  wrong-signature-algorithm (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing DECODING_­ERROR in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­EE_­KEY_­TOO_­SMALL, X509_­V_­OK, X509_­V_­ERR_­CERT_­SIGNATURE_­FAILURE
• GnuTLS: GNUTLS_­E_­CERTIFICATE_­ERROR, GNUTLS_­E_­SUCCESS
• Mbed TLS: MBEDTLS_­ERR_­X509_­SIG_­MISMATCH

(No detailed documentation provided by the library.)

Original error message:

Certificate serial number is negative (source)

(No detailed documentation provided by the library.)

Original error message:

Botan::Invalid_Argument (source)

(No detailed documentation provided by the library.)

Original error message:

Botan::Encoding_Error (source)

Example certificates

Below you can download one or more example malformed certificates causing ENCODING_­ERROR in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  nc-empty (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing ENCODING_­ERROR in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­OK
• GnuTLS: GNUTLS_­CERT_­UNEXPECTED_­OWNER
• Mbed TLS: MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS

(No detailed documentation provided by the library.)

Original error message:

No CRL with matching distribution point for certificate (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP cert not listed (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP requests not available (source)

(No detailed documentation provided by the library.)

Original error message:

Signature on OCSP response was found valid (source)

(No detailed documentation provided by the library.)

Original error message:

OCSP response accepted as affirming unrevoked status for certificate (source)

(No detailed documentation provided by the library.)

Original error message:

Valid CRL examined (source)

(No detailed documentation provided by the library.)

Original error message:

Verified (source)

Example certificates

Below you can download one or more example malformed certificates causing VERIFIED in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  bc-not-critical-ca (see the  generation script)
• Case  bc-path-len-in-non-ca (see the  generation script)
• Case  cert_revoked (see the  generation script)
• Case  crl_has_expired (see the  generation script)
• Case  crl_not_yet_valid (see the  generation script)
• Case  crl_path_validation_error (see the  generation script)
• Case  crl_signature_failure (see the  generation script)
• Case  different_crl_scope (see the  generation script)
• Case  empty-ext-key-usage (see the  generation script)
• Case  error_in_crl_last_update_field (see the  generation script)
• Case  error_in_crl_next_update_field (see the  generation script)
• Case  keyusage_no_crl_sign (see the  generation script)
• Case  nc-excluded-violation (see the  generation script)
• Case  negative-serial-number (see the  generation script)
• Case  no-key-usage-in-ca (see the  generation script)
• Case  san-empty-email (see the  generation script)
• Case  san-null-byte-in-email (see the  generation script)
• Case  signature-algorithm-mismatch (see the  generation script)
• Case  unable_to_get_crl (see the  generation script)
• Case  unhandled_critical_crl_extension (see the  generation script)
• Case  valid-with-aia (see the  generation script)
• Case  valid-with-crldp (see the  generation script)
• Case  valid (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing VERIFIED in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CA_­BCONS_­NOT_­CRITICAL, X509_­V_­ERR_­PATHLEN_­WITHOUT_­KU_­KEY_­CERT_­SIGN, X509_­V_­ERR_­CERT_­REVOKED, X509_­V_­ERR_­CRL_­HAS_­EXPIRED, X509_­V_­ERR_­CRL_­NOT_­YET_­VALID, X509_­V_­ERR_­CRL_­PATH_­VALIDATION_­ERROR, X509_­V_­ERR_­CRL_­SIGNATURE_­FAILURE, X509_­V_­ERR_­ERROR_­IN_­CRL_­LAST_­UPDATE_­FIELD, X509_­V_­ERR_­ERROR_­IN_­CRL_­NEXT_­UPDATE_­FIELD, X509_­V_­ERR_­KEYUSAGE_­NO_­CRL_­SIGN, X509_­V_­ERR_­EXCLUDED_­VIOLATION, X509_­V_­OK, X509_­V_­ERR_­CA_­CERT_­MISSING_­KEY_­USAGE, X509_­V_­ERR_­UNSUPPORTED_­NAME_­SYNTAX, X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY, X509_­V_­ERR_­UNABLE_­TO_­GET_­CRL, X509_­V_­ERR_­UNHANDLED_­CRITICAL_­CRL_­EXTENSION
• GnuTLS: GNUTLS_­E_­SUCCESS, GNUTLS_­CERT_­SIGNER_­CONSTRAINTS_­FAILURE, GNUTLS_­CERT_­UNEXPECTED_­OWNER, GNUTLS_­E_­CERTIFICATE_­ERROR
• Mbed TLS: MBEDTLS_­OK, MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS

(No detailed documentation provided by the library.)

Original error message:

Botan::TLS_Exception (source)

Example certificates

Below you can download one or more example malformed certificates causing TLS_­EXCEPTION in Botan. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  chain-loop (see the  generation script)
• Case  empty-key-usage-end-cert (see the  generation script)
• Case  end-entity-rsa-key-1024 (see the  generation script)
• Case  issuer-pubkey-info-invalid-oid (see the  generation script)
• Case  issuer-pubkey-invalid-oid-and-signature (see the  generation script)
• Case  v1-cert-with-extensions (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing TLS_­EXCEPTION in Botan? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY, X509_­V_­ERR_­EE_­KEY_­TOO_­SMALL, X509_­V_­ERR_­EXTENSIONS_­REQUIRE_­VERSION_­3
• GnuTLS: GNUTLS_­CERT_­SIGNER_­NOT_­FOUND, GNUTLS_­E_­KEY_­USAGE_­VIOLATION, GNUTLS_­CERT_­INSECURE_­ALGORITHM, GNUTLS_­E_­CERTIFICATE_­ERROR
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­KEY_­USAGE, MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED, MBEDTLS_­X509_­BADCERT_­BAD_­KEY, MBEDTLS_­ERR_­X509_­INVALID_­FORMAT