GnuTLS: X.509 errors

Original documentation:

The certificate is not yet activated. (source)

Original error message:

The certificate chain uses not yet valid certificate. (source)

Example certificates

Below you can download one or more example malformed certificates causing GNUTLS_­CERT_­NOT_­ACTIVATED in GnuTLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  not-yet-valid (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing GNUTLS_­CERT_­NOT_­ACTIVATED in GnuTLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CERT_­NOT_­YET_­VALID
• Botan: CERT_­NOT_­YET_­VALID
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­FUTURE

Original documentation:

The certificate has expired. (source)

Original error message:

The certificate chain uses expired certificate. (source)

Example certificates

Below you can download one or more example malformed certificates causing GNUTLS_­CERT_­EXPIRED in GnuTLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  expired (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing GNUTLS_­CERT_­EXPIRED in GnuTLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CERT_­HAS_­EXPIRED
• Botan: CERT_­HAS_­EXPIRED
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­EXPIRED

Original documentation:

The revocation data have a future issue date. (source)

Original error message:

The revocation or OCSP data are issued with a future date. (source)

Original documentation:

The revocation data are old and have been superseded. (source)

Original error message:

The revocation or OCSP data are old and have been superseded. (source)

Original documentation:

Certificate is revoked by its authority. In X.509 this will be set only if CRLs are checked. (source)

Original error message:

The certificate chain is revoked. (source)

Original documentation:

The certificate is not signed by one of the known authorities or the signature is invalid (deprecated by the flags GNUTLS_CERT_SIGNATURE_FAILURE and GNUTLS_CERT_SIGNER_NOT_FOUND ). (source)

Original error message:

The certificate is not signed by one of the known authorities or the signature is invalid. (source)

Unused: The documentation states that this error code is not used anymore.

Original documentation:

The certificate’s issuer is not known. This is the case if the issuer is not included in the trusted certificate list. (source)

Original error message:

The certificate issuer is unknown. (source)

Example certificates

Below you can download one or more example malformed certificates causing GNUTLS_­CERT_­SIGNER_­NOT_­FOUND in GnuTLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  chain-loop (see the  generation script)
• Case  issuer-no-match-subject (see the  generation script)
• Case  self-signed-intermediate (see the  generation script)
• Case  unknown-root-cn (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing GNUTLS_­CERT_­SIGNER_­NOT_­FOUND in GnuTLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY
• Botan: TLS_­EXCEPTION, CERT_­ISSUER_­NOT_­FOUND, CANNOT_­ESTABLISH_­TRUST
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­KEY_­USAGE, MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED

Original documentation:

The certificate requires the server to send the certifiate status, but no status was received. (source)

Original error message:

The certificate requires the server to include an OCSP status in its response, but the OCSP status is missing. (source)

Original documentation:

The received OCSP status response is invalid. (source)

Original error message:

The received OCSP status response is invalid. (source)

Original documentation:

The certificate presented isn’t the expected one (TOFU) (source)

Original error message:

The certificate doesn't match the local copy (TOFU). (source)

(No detailed documentation provided by the library.)

Original error message:

The OCSP response provided doesn’t match the available certificates (source)

Original documentation:

The certificate has extensions marked as critical which are not supported. (source)

Original error message:

The certificate contains an unknown critical extension. (source)

Example certificates

Below you can download one or more example malformed certificates causing GNUTLS_­CERT_­UNKNOWN_­CRIT_­EXTENSIONS in GnuTLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  empty-ip-addr-blocks (see the  generation script)
• Case  ip-addr-blocks-no-subset (see the  generation script)
• Case  unknown-critical-extension (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing GNUTLS_­CERT_­UNKNOWN_­CRIT_­EXTENSIONS in GnuTLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­INVALID_­EXTENSION, X509_­V_­ERR_­UNNESTED_­RESOURCE, X509_­V_­ERR_­UNHANDLED_­CRITICAL_­EXTENSION
• Botan: UNKNOWN_­CRITICAL_­EXTENSION
• Mbed TLS: MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS

Original documentation:

The certificate’s signer was not a CA. This may happen if this was a version 1 certificate, which is common with some CAs, or a version 3 certificate without the basic constrains extension. (source)

Original error message:

The certificate issuer is not a CA. (source)

Example certificates

Below you can download one or more example malformed certificates causing GNUTLS_­CERT_­SIGNER_­NOT_­CA in GnuTLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  issuer-ca-false (see the  generation script)
• Case  proxy-length-exceeded (see the  generation script)
• Case  proxy-name-no-match-issuer (see the  generation script)
• Case  proxy-with-san (see the  generation script)
• Case  valid-proxy (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing GNUTLS_­CERT_­SIGNER_­NOT_­CA in GnuTLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­INVALID_­CA, X509_­V_­ERR_­PROXY_­PATH_­LENGTH_­EXCEEDED, X509_­V_­ERR_­PROXY_­SUBJECT_­NAME_­VIOLATION, X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY, X509_­V_­OK
• Botan: CA_­CERT_­NOT_­FOR_­CERT_­ISSUER, UNKNOWN_­CRITICAL_­EXTENSION
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED, MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS

Original documentation:

The owner is not the expected one. (source)

Original error message:

The name in the certificate does not match the expected. (source)

Example certificates

Below you can download one or more example malformed certificates causing GNUTLS_­CERT_­UNEXPECTED_­OWNER in GnuTLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  empty-subject-and-no-san (see the  generation script)
• Case  host-no-match-cn (see the  generation script)
• Case  nc-empty (see the  generation script)
• Case  nc-excluded-violation (see the  generation script)
• Case  nc-maximum-present (see the  generation script)
• Case  nc-minimum-not-zero (see the  generation script)
• Case  nc-permitted-violation (see the  generation script)
• Case  proxy-length-exceeded (see the  generation script)
• Case  proxy-with-san (see the  generation script)
• Case  unknown-ext-key-usage (see the  generation script)
• Case  valid-proxy (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing GNUTLS_­CERT_­UNEXPECTED_­OWNER in GnuTLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­OK, X509_­V_­ERR_­EXCLUDED_­VIOLATION, X509_­V_­ERR_­SUBTREE_­MINMAX, X509_­V_­ERR_­PERMITTED_­VIOLATION, X509_­V_­ERR_­PROXY_­PATH_­LENGTH_­EXCEEDED, X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY
• Botan: CERT_­NAME_­NOMATCH, ENCODING_­ERROR, VERIFIED, NAME_­CONSTRAINT_­ERROR, UNKNOWN_­CRITICAL_­EXTENSION, INVALID_­USAGE
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­CN_­MISMATCH, MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS, MBEDTLS_­X509_­BADCERT_­EXT_­KEY_­USAGE

Original documentation:

The certificate’s signer constraints were violated. (source)

Original error message:

The certificate chain violates the signer's constraints. (source)

Example certificates

Below you can download one or more example malformed certificates causing GNUTLS_­CERT_­SIGNER_­CONSTRAINTS_­FAILURE in GnuTLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  bc-path-len-exceeded (see the  generation script)
• Case  nc-excluded-violation (see the  generation script)
• Case  nc-maximum-present (see the  generation script)
• Case  nc-minimum-not-zero (see the  generation script)
• Case  nc-permitted-violation (see the  generation script)
• Case  nc-unknown-name-type (see the  generation script)
• Case  no-certsign-in-keyusage (see the  generation script)
• Case  proxy-length-exceeded (see the  generation script)
• Case  proxy-name-no-match-issuer (see the  generation script)
• Case  proxy-with-san (see the  generation script)
• Case  valid-proxy (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing GNUTLS_­CERT_­SIGNER_­CONSTRAINTS_­FAILURE in GnuTLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­PATH_­LENGTH_­EXCEEDED, X509_­V_­ERR_­EXCLUDED_­VIOLATION, X509_­V_­ERR_­SUBTREE_­MINMAX, X509_­V_­ERR_­PERMITTED_­VIOLATION, X509_­V_­ERR_­INVALID_­CA, X509_­V_­ERR_­PROXY_­PATH_­LENGTH_­EXCEEDED, X509_­V_­ERR_­PROXY_­SUBJECT_­NAME_­VIOLATION, X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY, X509_­V_­OK
• Botan: CERT_­CHAIN_­TOO_­LONG, VERIFIED, NAME_­CONSTRAINT_­ERROR, UNKNOWN_­CRITICAL_­EXTENSION, CA_­CERT_­NOT_­FOR_­CERT_­ISSUER
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED, MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS

Original documentation:

The certificate or an intermediate does not match the intended purpose (extended key usage). (source)

Original error message:

The certificate chain does not match the intended purpose. (source)

(No detailed documentation provided by the library.)

Original error message:

Key usage violation in certificate has been detected. (source)

Example certificates

Below you can download one or more example malformed certificates causing GNUTLS_­E_­KEY_­USAGE_­VIOLATION in GnuTLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  chain-loop (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing GNUTLS_­E_­KEY_­USAGE_­VIOLATION in GnuTLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY
• Botan: TLS_­EXCEPTION
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­KEY_­USAGE, MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED

Original documentation:

The certificate was signed using an insecure algorithm such as MD2 or MD5. These algorithms have been broken and should not be trusted. (source)

Original error message:

The certificate chain uses insecure algorithm. (source)

Example certificates

Below you can download one or more example malformed certificates causing GNUTLS_­CERT_­INSECURE_­ALGORITHM in GnuTLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  end-entity-rsa-key-1024 (see the  generation script)
• Case  issuer-hash-md5 (see the  generation script)
• Case  issuer-rsa-key-1024 (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing GNUTLS_­CERT_­INSECURE_­ALGORITHM in GnuTLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­EE_­KEY_­TOO_­SMALL, X509_­V_­ERR_­CA_­MD_­TOO_­WEAK, X509_­V_­ERR_­CA_­KEY_­TOO_­SMALL
• Botan: TLS_­EXCEPTION, UNTRUSTED_­HASH, SIGNATURE_­METHOD_­TOO_­WEAK
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­BAD_­KEY, MBEDTLS_­X509_­BADCERT_­BAD_­MD

Original documentation:

The signature verification failed. (source)

Original error message:

The signature in the certificate is invalid. (source)

Example certificates

Below you can download one or more example malformed certificates causing GNUTLS_­CERT_­SIGNATURE_­FAILURE in GnuTLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  invalid-signature (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing GNUTLS_­CERT_­SIGNATURE_­FAILURE in GnuTLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CERT_­SIGNATURE_­FAILURE
• Botan: SIGNATURE_­ERROR
• Mbed TLS: MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED

(No detailed documentation provided by the library.)

Original error message:

Error in the certificate. (source)

Example certificates

Below you can download one or more example malformed certificates causing GNUTLS_­E_­CERTIFICATE_­ERROR in GnuTLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  duplicate-bc-extension (see the  generation script)
• Case  issuer-pubkey-info-invalid-oid (see the  generation script)
• Case  issuer-pubkey-invalid-oid-and-signature (see the  generation script)
• Case  pubkey-info-invalid-oid (see the  generation script)
• Case  san-empty-email (see the  generation script)
• Case  signature-algorithm-mismatch (see the  generation script)
• Case  v1-cert-with-extensions (see the  generation script)
• Case  wrong-signature-algorithm (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing GNUTLS_­E_­CERTIFICATE_­ERROR in GnuTLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY, X509_­V_­ERR_­EE_­KEY_­TOO_­SMALL, X509_­V_­ERR_­UNSUPPORTED_­NAME_­SYNTAX, X509_­V_­ERR_­EXTENSIONS_­REQUIRE_­VERSION_­3, X509_­V_­ERR_­CERT_­SIGNATURE_­FAILURE
• Botan: DUPLICATE_­CERT_­EXTENSION, TLS_­EXCEPTION, DECODING_­ERROR, VERIFIED
• Mbed TLS: MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS, MBEDTLS_­ERR_­X509_­INVALID_­FORMAT, MBEDTLS_­ERR_­X509_­SIG_­MISMATCH

(No detailed documentation provided by the library.)

Original error message:

The certificate type is not supported. (source)

(No detailed documentation provided by the library.)

Original error message:

Unknown Subject Alternative name in X.509 certificate. (source)

(No detailed documentation provided by the library.)

Original error message:

ASN1 parser: Error in DER parsing. (source)

Example certificates

Below you can download one or more example malformed certificates causing GNUTLS_­E_­ASN1_­DER_­ERROR in GnuTLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  notafter-field-invalid (see the  generation script)
• Case  notbefore-field-invalid (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing GNUTLS_­E_­ASN1_­DER_­ERROR in GnuTLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­ERROR_­IN_­CERT_­NOT_­AFTER_­FIELD, X509_­V_­ERR_­ERROR_­IN_­CERT_­NOT_­BEFORE_­FIELD
• Mbed TLS: MBEDTLS_­ERR_­X509_­INVALID_­DATE

(No detailed documentation provided by the library.)

Original error message:

The certificate has unsupported attributes. (source)

(No detailed documentation provided by the library.)

Original error message:

The OID is not supported. (source)

(No detailed documentation provided by the library.)

Original error message:

Duplicate extension in X.509 certificate. (source)

(No detailed documentation provided by the library.)

Original error message:

The certificate is trusted. (source)

Example certificates

Below you can download one or more example malformed certificates causing GNUTLS_­E_­SUCCESS in GnuTLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  any-ext-key-usage (see the  generation script)
• Case  bc-not-critical-ca (see the  generation script)
• Case  bc-path-len-in-non-ca (see the  generation script)
• Case  bc-path-len-negative (see the  generation script)
• Case  cert_revoked (see the  generation script)
• Case  crl_has_expired (see the  generation script)
• Case  crl_not_yet_valid (see the  generation script)
• Case  crl_path_validation_error (see the  generation script)
• Case  crl_signature_failure (see the  generation script)
• Case  different_crl_scope (see the  generation script)
• Case  empty-ext-key-usage (see the  generation script)
• Case  error_in_crl_last_update_field (see the  generation script)
• Case  error_in_crl_next_update_field (see the  generation script)
• Case  keyusage_no_crl_sign (see the  generation script)
• Case  negative-serial-number (see the  generation script)
• Case  no-key-usage-in-ca (see the  generation script)
• Case  proxy-ca (see the  generation script)
• Case  san-null-byte-in-email (see the  generation script)
• Case  trusted-only-intermediate (see the  generation script)
• Case  unable_to_get_crl (see the  generation script)
• Case  unhandled_critical_crl_extension (see the  generation script)
• Case  v4-cert (see the  generation script)
• Case  valid-with-aia (see the  generation script)
• Case  valid-with-crldp (see the  generation script)
• Case  valid (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing GNUTLS_­E_­SUCCESS in GnuTLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CA_­BCONS_­NOT_­CRITICAL, X509_­V_­ERR_­PATHLEN_­WITHOUT_­KU_­KEY_­CERT_­SIGN, X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY, X509_­V_­ERR_­CERT_­REVOKED, X509_­V_­ERR_­CRL_­HAS_­EXPIRED, X509_­V_­ERR_­CRL_­NOT_­YET_­VALID, X509_­V_­ERR_­CRL_­PATH_­VALIDATION_­ERROR, X509_­V_­ERR_­CRL_­SIGNATURE_­FAILURE, X509_­V_­ERR_­ERROR_­IN_­CRL_­LAST_­UPDATE_­FIELD, X509_­V_­ERR_­ERROR_­IN_­CRL_­NEXT_­UPDATE_­FIELD, X509_­V_­ERR_­KEYUSAGE_­NO_­CRL_­SIGN, X509_­V_­OK, X509_­V_­ERR_­CA_­CERT_­MISSING_­KEY_­USAGE, X509_­V_­ERR_­INVALID_­NON_­CA, X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT, X509_­V_­ERR_­UNABLE_­TO_­GET_­CRL, X509_­V_­ERR_­UNHANDLED_­CRITICAL_­CRL_­EXTENSION
• Botan: INVALID_­USAGE, VERIFIED, UNKNOWN_­CRITICAL_­EXTENSION, CERT_­ISSUER_­NOT_­FOUND, DECODING_­ERROR
• Mbed TLS: MBEDTLS_­OK, MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS