Mbed TLS: X.509 errors

Original documentation:

The certificate validity starts in the future. (source)

Original error message:

The certificate validity starts in the future (source)

Example certificates

Below you can download one or more example malformed certificates causing MBEDTLS_­X509_­BADCERT_­FUTURE in Mbed TLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  not-yet-valid (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing MBEDTLS_­X509_­BADCERT_­FUTURE in Mbed TLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CERT_­NOT_­YET_­VALID
• GnuTLS: GNUTLS_­CERT_­NOT_­ACTIVATED
• Botan: CERT_­NOT_­YET_­VALID

Original documentation:

The certificate validity has expired. (source)

Original error message:

The certificate validity has expired (source)

Example certificates

Below you can download one or more example malformed certificates causing MBEDTLS_­X509_­BADCERT_­EXPIRED in Mbed TLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  expired (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing MBEDTLS_­X509_­BADCERT_­EXPIRED in Mbed TLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CERT_­HAS_­EXPIRED
• GnuTLS: GNUTLS_­CERT_­EXPIRED
• Botan: CERT_­HAS_­EXPIRED

Original documentation:

The CRL is from the future. (source)

Original error message:

The CRL is from the future (source)

Original documentation:

The CRL is expired. (source)

Original error message:

The CRL is expired (source)

Original documentation:

The certificate has been revoked (is on a CRL). (source)

Original error message:

The certificate has been revoked (is on a CRL) (source)

Original documentation:

The certificate is not correctly signed by the trusted CA. (source)

Original error message:

The certificate is not correctly signed by the trusted CA (source)

Example certificates

Below you can download one or more example malformed certificates causing MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED in Mbed TLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  bc-path-len-exceeded (see the  generation script)
• Case  chain-loop (see the  generation script)
• Case  invalid-signature (see the  generation script)
• Case  issuer-ca-false (see the  generation script)
• Case  issuer-no-match-subject (see the  generation script)
• Case  no-certsign-in-keyusage (see the  generation script)
• Case  self-signed-end-entity (see the  generation script)
• Case  self-signed-intermediate (see the  generation script)
• Case  unknown-root-cn (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing MBEDTLS_­X509_­BADCERT_­NOT_­TRUSTED in Mbed TLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­PATH_­LENGTH_­EXCEEDED, X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY, X509_­V_­ERR_­CERT_­SIGNATURE_­FAILURE, X509_­V_­ERR_­INVALID_­CA
• GnuTLS: GNUTLS_­CERT_­SIGNER_­CONSTRAINTS_­FAILURE, GNUTLS_­CERT_­SIGNER_­NOT_­FOUND, GNUTLS_­E_­KEY_­USAGE_­VIOLATION, GNUTLS_­CERT_­SIGNATURE_­FAILURE, GNUTLS_­CERT_­SIGNER_­NOT_­CA
• Botan: CERT_­CHAIN_­TOO_­LONG, TLS_­EXCEPTION, SIGNATURE_­ERROR, CA_­CERT_­NOT_­FOR_­CERT_­ISSUER, CERT_­ISSUER_­NOT_­FOUND, CANNOT_­ESTABLISH_­TRUST

Original documentation:

The CRL is not correctly signed by the trusted CA. (source)

Original error message:

The CRL is not correctly signed by the trusted CA (source)

Original documentation:

The certificate Common Name (CN) does not match with the expected CN. (source)

Original error message:

The certificate Common Name (CN) does not match with the expected CN (source)

Example certificates

Below you can download one or more example malformed certificates causing MBEDTLS_­X509_­BADCERT_­CN_­MISMATCH in Mbed TLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  empty-subject-and-no-san (see the  generation script)
• Case  host-no-match-cn (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing MBEDTLS_­X509_­BADCERT_­CN_­MISMATCH in Mbed TLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• GnuTLS: GNUTLS_­CERT_­UNEXPECTED_­OWNER
• Botan: CERT_­NAME_­NOMATCH

Original documentation:

Usage does not match the nsCertType extension. (source)

Original error message:

Usage does not match the nsCertType extension (source)

Original documentation:

Usage does not match the keyUsage extension. (source)

Original error message:

Usage does not match the keyUsage extension (source)

Example certificates

Below you can download one or more example malformed certificates causing MBEDTLS_­X509_­BADCERT_­KEY_­USAGE in Mbed TLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  chain-loop (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing MBEDTLS_­X509_­BADCERT_­KEY_­USAGE in Mbed TLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY
• GnuTLS: GNUTLS_­CERT_­SIGNER_­NOT_­FOUND, GNUTLS_­E_­KEY_­USAGE_­VIOLATION
• Botan: TLS_­EXCEPTION

Original documentation:

Usage does not match the extendedKeyUsage extension. (source)

Original error message:

Usage does not match the extendedKeyUsage extension (source)

Example certificates

Below you can download one or more example malformed certificates causing MBEDTLS_­X509_­BADCERT_­EXT_­KEY_­USAGE in Mbed TLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  unknown-ext-key-usage (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing MBEDTLS_­X509_­BADCERT_­EXT_­KEY_­USAGE in Mbed TLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• GnuTLS: GNUTLS_­CERT_­UNEXPECTED_­OWNER
• Botan: INVALID_­USAGE

Original documentation:

The certificate is signed with an unacceptable key (eg bad curve, RSA too short). (source)

Original error message:

The certificate is signed with an unacceptable key (eg bad curve, RSA too short). (source)

Example certificates

Below you can download one or more example malformed certificates causing MBEDTLS_­X509_­BADCERT_­BAD_­KEY in Mbed TLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  end-entity-rsa-key-1024 (see the  generation script)
• Case  issuer-rsa-key-1024 (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing MBEDTLS_­X509_­BADCERT_­BAD_­KEY in Mbed TLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­EE_­KEY_­TOO_­SMALL, X509_­V_­ERR_­CA_­KEY_­TOO_­SMALL
• GnuTLS: GNUTLS_­CERT_­INSECURE_­ALGORITHM
• Botan: TLS_­EXCEPTION, SIGNATURE_­METHOD_­TOO_­WEAK

Original documentation:

The CRL is signed with an unacceptable key (eg bad curve, RSA too short). (source)

Original error message:

The CRL is signed with an unacceptable key (eg bad curve, RSA too short). (source)

Original documentation:

The certificate is signed with an unacceptable PK alg (eg RSA vs ECDSA). (source)

Original error message:

The certificate is signed with an unacceptable PK alg (eg RSA vs ECDSA). (source)

Original documentation:

The CRL is signed with an unacceptable PK alg (eg RSA vs ECDSA). (source)

Original error message:

The CRL is signed with an unacceptable PK alg (eg RSA vs ECDSA). (source)

Original documentation:

The certificate is signed with an unacceptable hash. (source)

Original error message:

The certificate is signed with an unacceptable hash. (source)

Example certificates

Below you can download one or more example malformed certificates causing MBEDTLS_­X509_­BADCERT_­BAD_­MD in Mbed TLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  issuer-hash-md5 (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing MBEDTLS_­X509_­BADCERT_­BAD_­MD in Mbed TLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CA_­MD_­TOO_­WEAK
• GnuTLS: GNUTLS_­CERT_­INSECURE_­ALGORITHM
• Botan: UNTRUSTED_­HASH

Original documentation:

The CRL is signed with an unacceptable hash. (source)

Original error message:

The CRL is signed with an unacceptable hash. (source)

Original documentation:

Signature algorithm (oid) is unsupported. (source)

Original error message:

X509 - Signature algorithm (oid) is unsupported (source)

Original documentation:

Unavailable feature, e.g. RSA hashing/encryption combination. (source)

Original error message:

X509 - Unavailable feature, e.g. RSA hashing/encryption combination (source)

Original documentation:

Format not recognized as DER or PEM. (source)

Original error message:

X509 - Format not recognized as DER or PEM (source)

Original documentation:

Signature algorithms do not match. (source)

Original error message:

X509 - Signature algorithms do not match. (source)

Example certificates

Below you can download one or more example malformed certificates causing MBEDTLS_­ERR_­X509_­SIG_­MISMATCH in Mbed TLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  wrong-signature-algorithm (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing MBEDTLS_­ERR_­X509_­SIG_­MISMATCH in Mbed TLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CERT_­SIGNATURE_­FAILURE
• GnuTLS: GNUTLS_­E_­CERTIFICATE_­ERROR
• Botan: DECODING_­ERROR

Original documentation:

Requested OID is unknown. (source)

Original error message:

X509 - Requested OID is unknown (source)

Original documentation:

The CRT/CRL/CSR version element is invalid. (source)

Original error message:

X509 - The CRT/CRL/CSR version element is invalid (source)

Original documentation:

The signature tag or value invalid. (source)

Original error message:

X509 - The signature tag or value invalid (source)

Original documentation:

The serial tag or value is invalid. (source)

Original error message:

X509 - The serial tag or value is invalid (source)

Original documentation:

The name tag or value is invalid. (source)

Original error message:

X509 - The name tag or value is invalid (source)

Original documentation:

The CRT/CRL/CSR format is invalid, e.g. different type expected. (source)

Original error message:

X509 - The CRT/CRL/CSR format is invalid, e.g. different type expected (source)

Example certificates

Below you can download one or more example malformed certificates causing MBEDTLS_­ERR_­X509_­INVALID_­FORMAT in Mbed TLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  v1-cert-with-extensions (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing MBEDTLS_­ERR_­X509_­INVALID_­FORMAT in Mbed TLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­EXTENSIONS_­REQUIRE_­VERSION_­3
• GnuTLS: GNUTLS_­E_­CERTIFICATE_­ERROR
• Botan: TLS_­EXCEPTION

Original documentation:

The extension tag or value is invalid. (source)

Original error message:

X509 - The extension tag or value is invalid (source)

Example certificates

Below you can download one or more example malformed certificates causing MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS in Mbed TLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  bc-path-len-negative (see the  generation script)
• Case  duplicate-bc-extension (see the  generation script)
• Case  empty-ext-key-usage (see the  generation script)
• Case  empty-ip-addr-blocks (see the  generation script)
• Case  ip-addr-blocks-no-subset (see the  generation script)
• Case  nc-empty (see the  generation script)
• Case  nc-excluded-violation (see the  generation script)
• Case  nc-maximum-present (see the  generation script)
• Case  nc-minimum-not-zero (see the  generation script)
• Case  nc-permitted-violation (see the  generation script)
• Case  nc-unknown-name-type (see the  generation script)
• Case  proxy-ca (see the  generation script)
• Case  proxy-length-exceeded (see the  generation script)
• Case  proxy-name-no-match-issuer (see the  generation script)
• Case  proxy-with-san (see the  generation script)
• Case  san-empty-email (see the  generation script)
• Case  san-null-byte-in-email (see the  generation script)
• Case  unknown-critical-extension (see the  generation script)
• Case  valid-proxy (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing MBEDTLS_­ERR_­X509_­INVALID_­EXTENSIONS in Mbed TLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT_­LOCALLY, X509_­V_­ERR_­INVALID_­EXTENSION, X509_­V_­ERR_­UNNESTED_­RESOURCE, X509_­V_­OK, X509_­V_­ERR_­EXCLUDED_­VIOLATION, X509_­V_­ERR_­SUBTREE_­MINMAX, X509_­V_­ERR_­PERMITTED_­VIOLATION, X509_­V_­ERR_­INVALID_­NON_­CA, X509_­V_­ERR_­PROXY_­PATH_­LENGTH_­EXCEEDED, X509_­V_­ERR_­PROXY_­SUBJECT_­NAME_­VIOLATION, X509_­V_­ERR_­UNSUPPORTED_­NAME_­SYNTAX, X509_­V_­ERR_­UNHANDLED_­CRITICAL_­EXTENSION
• GnuTLS: GNUTLS_­E_­SUCCESS, GNUTLS_­E_­CERTIFICATE_­ERROR, GNUTLS_­CERT_­UNKNOWN_­CRIT_­EXTENSIONS, GNUTLS_­CERT_­UNEXPECTED_­OWNER, GNUTLS_­CERT_­SIGNER_­CONSTRAINTS_­FAILURE, GNUTLS_­CERT_­SIGNER_­NOT_­CA
• Botan: UNKNOWN_­CRITICAL_­EXTENSION, DUPLICATE_­CERT_­EXTENSION, VERIFIED, ENCODING_­ERROR, NAME_­CONSTRAINT_­ERROR

Original documentation:

The date tag or value is invalid. (source)

Original error message:

X509 - The date tag or value is invalid (source)

Example certificates

Below you can download one or more example malformed certificates causing MBEDTLS_­ERR_­X509_­INVALID_­DATE in Mbed TLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  notafter-field-invalid (see the  generation script)
• Case  notbefore-field-invalid (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing MBEDTLS_­ERR_­X509_­INVALID_­DATE in Mbed TLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­ERROR_­IN_­CERT_­NOT_­AFTER_­FIELD, X509_­V_­ERR_­ERROR_­IN_­CERT_­NOT_­BEFORE_­FIELD
• GnuTLS: GNUTLS_­E_­ASN1_­DER_­ERROR

Original documentation:

The algorithm tag or value is invalid. (source)

Original error message:

X509 - The algorithm tag or value is invalid (source)

Original documentation:

Format not recognized as DER or PEM. (source)

Original error message:

X509 - Format not recognized as DER or PEM (source)

Original documentation:

Input invalid. (source)

Original error message:

X509 - Input invalid (source)

Original documentation:

Certificate was missing. (source)

Original error message:

Certificate was missing (source)

Original documentation:

Other reason (can be used by verify callback). (source)

Original error message:

Other reason (can be used by verify callback) (source)

Original documentation:

Certificate verification was skipped. (source)

Original error message:

Certificate verification was skipped (source)

Original documentation:

A fatal error occured, eg the chain is too long or the vrfy callback failed. (source)

Original error message:

X509 - A fatal error occurred, eg the chain is too long or the vrfy callback failed (source)

Original documentation:

Allocation of memory failed. (source)

Original error message:

X509 - Allocation of memory failed (source)

Original documentation:

Destination buffer is too small. (source)

Original error message:

X509 - Destination buffer is too small (source)

Original documentation:

Certificate verification failed, e.g. CRL, CA or signature check failed. (source)

Original error message:

X509 - Certificate verification failed, e.g. CRL, CA or signature check failed (source)

Original documentation:

Read/write of file failed. (source)

Original error message:

X509 - Read/write of file failed (source)

(No detailed documentation provided by the library.)

Original error message:

ok (source)

Example certificates

Below you can download one or more example malformed certificates causing MBEDTLS_­OK in Mbed TLS. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.

• Case  any-ext-key-usage (see the  generation script)
• Case  bc-not-critical-ca (see the  generation script)
• Case  bc-path-len-in-non-ca (see the  generation script)
• Case  cert_revoked (see the  generation script)
• Case  crl_has_expired (see the  generation script)
• Case  crl_not_yet_valid (see the  generation script)
• Case  crl_path_validation_error (see the  generation script)
• Case  crl_signature_failure (see the  generation script)
• Case  different_crl_scope (see the  generation script)
• Case  error_in_crl_last_update_field (see the  generation script)
• Case  error_in_crl_next_update_field (see the  generation script)
• Case  keyusage_no_crl_sign (see the  generation script)
• Case  negative-serial-number (see the  generation script)
• Case  no-key-usage-in-ca (see the  generation script)
• Case  trusted-only-intermediate (see the  generation script)
• Case  unable_to_get_crl (see the  generation script)
• Case  unhandled_critical_crl_extension (see the  generation script)
• Case  valid-with-aia (see the  generation script)
• Case  valid-with-crldp (see the  generation script)
• Case  valid (see the  generation script)

Corresponding errors

What validation errors do other libraries give for certificates causing MBEDTLS_­OK in Mbed TLS? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)

• OpenSSL: X509_­V_­ERR_­CA_­BCONS_­NOT_­CRITICAL, X509_­V_­ERR_­PATHLEN_­WITHOUT_­KU_­KEY_­CERT_­SIGN, X509_­V_­ERR_­CERT_­REVOKED, X509_­V_­ERR_­CRL_­HAS_­EXPIRED, X509_­V_­ERR_­CRL_­NOT_­YET_­VALID, X509_­V_­ERR_­CRL_­PATH_­VALIDATION_­ERROR, X509_­V_­ERR_­CRL_­SIGNATURE_­FAILURE, X509_­V_­ERR_­ERROR_­IN_­CRL_­LAST_­UPDATE_­FIELD, X509_­V_­ERR_­ERROR_­IN_­CRL_­NEXT_­UPDATE_­FIELD, X509_­V_­ERR_­KEYUSAGE_­NO_­CRL_­SIGN, X509_­V_­OK, X509_­V_­ERR_­CA_­CERT_­MISSING_­KEY_­USAGE, X509_­V_­ERR_­UNABLE_­TO_­GET_­ISSUER_­CERT, X509_­V_­ERR_­UNABLE_­TO_­GET_­CRL, X509_­V_­ERR_­UNHANDLED_­CRITICAL_­CRL_­EXTENSION
• GnuTLS: GNUTLS_­E_­SUCCESS
• Botan: INVALID_­USAGE, VERIFIED, CERT_­ISSUER_­NOT_­FOUND