OpenJDK: X.509 errors
Our goal is to simplify the ecosystem by consolidating the errors and their documentation (similarly to web documentation) and better explaining what the validation errors mean.
Correctly validating X.509 certificates turns out to be pretty complicated (e.g., Georgiev2012, Ukrop2019). Yet certificate validation is crucial for secure communication on the Internet (think TLS).
For every error, we aim to provide our redesigned documentation ( ), an example certificate ( ), original documentation provided by the library ( , unused or deprecated errors denoted by ). Furthermore, we provide links to corresponding errors from other libraries ( ). In the future, we plan on adding error frequencies based on IP-wide scans and elaborating on the consequences of individual errors.
Time validity errors
Errors occuring when a certificate is outside its validity period or when it is revoked by its CA.
Relevant links: Certificate Validity (RFC 5280), Certificate Revocation (RFC 5280)
(No detailed documentation provided by the library.)
Original error message:
java.security.cert.CertPathValidatorException: validity check failed (source)
Example certificates
Below you can download one or more example malformed certificates causing VALIDITY_CHECK_FAILED in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case expired (see the generation script)
- Case not-yet-valid (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing VALIDITY_CHECK_FAILED in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
Trust or chain related errors
These errors occur when the trust chain to the root certificate is not built correctly or fails.
Relevant links: Certificate Paths (RFC 5280), Certificate Revocation Lists (RFC 5280), OCSP (RFC 2560)
(No detailed documentation provided by the library.)
Original error message:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target (source)
Example certificates
Below you can download one or more example malformed certificates causing UNABLE_TO_FIND_VALID_CERTIFICATION_PATH in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case chain-loop (see the generation script)
- Case issuer-no-match-subject (see the generation script)
- Case self-signed-end-entity (see the generation script)
- Case self-signed-intermediate (see the generation script)
- Case unknown-root-cn (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing UNABLE_TO_FIND_VALID_CERTIFICATION_PATH in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
- OpenSSL: X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH, X509_V_ERR_AKID_SKID_MISMATCH, X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY
- GnuTLS: GNUTLS_CERT_SIGNER_NOT_FOUND, GNUTLS_E_KEY_USAGE_VIOLATION
- Botan: TLS_EXCEPTION, CERT_ISSUER_NOT_FOUND, CANNOT_ESTABLISH_TRUST
- Mbed TLS: MBEDTLS_X509_BADCERT_KEY_USAGE, MBEDTLS_X509_BADCERT_NOT_TRUSTED
Basic extension errors
Errors related to extensions in general or to the BasicConstraints standard extension.
Relevant links: Certificate Extensions (RFC 5280), BasicConstraints Extension (RFC 5280)
(No detailed documentation provided by the library.)
Original error message:
java.security.cert.CertPathValidatorException: basic constraints check failed: pathLenConstraint violated - this cert must be the last cert in the certification path (source)
Example certificates
Below you can download one or more example malformed certificates causing PATH_LEN_CONSTRAINT_VIOLATED in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case bc-path-len-exceeded (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing PATH_LEN_CONSTRAINT_VIOLATED in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
- OpenSSL: X509_V_ERR_PATH_LENGTH_EXCEEDED
- GnuTLS: GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE
- Botan: CERT_CHAIN_TOO_LONG
- Mbed TLS: MBEDTLS_X509_BADCERT_NOT_TRUSTED
(No detailed documentation provided by the library.)
Original error message:
java.security.cert.CertPathValidatorException: unrecognized critical extension(s) (source)
Example certificates
Below you can download one or more example malformed certificates causing UNRECOGNIZED_CRITICAL_EXTENSION in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case empty-ip-addr-blocks (see the generation script)
- Case ip-addr-blocks-no-subset (see the generation script)
- Case proxy-ca (see the generation script)
- Case unknown-critical-extension (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing UNRECOGNIZED_CRITICAL_EXTENSION in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
- OpenSSL: X509_V_ERR_INVALID_EXTENSION, X509_V_ERR_UNNESTED_RESOURCE, X509_V_ERR_INVALID_NON_CA, X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION
- GnuTLS: GNUTLS_CERT_UNKNOWN_CRIT_EXTENSIONS, GNUTLS_E_SUCCESS
- Botan: UNKNOWN_CRITICAL_EXTENSION
- Mbed TLS: MBEDTLS_ERR_X509_INVALID_EXTENSIONS
(No detailed documentation provided by the library.)
Original error message:
java.security.cert.CertPathValidatorException: basic constraints check failed: this is not a CA certificate (source)
Example certificates
Below you can download one or more example malformed certificates causing NOT_A_CA_CERTIFICATE in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case issuer-ca-false (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing NOT_A_CA_CERTIFICATE in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
- OpenSSL: X509_V_ERR_INVALID_CA
- GnuTLS: GNUTLS_CERT_SIGNER_NOT_CA
- Botan: CA_CERT_NOT_FOR_CERT_ISSUER
- Mbed TLS: MBEDTLS_X509_BADCERT_NOT_TRUSTED
Name related errors
Errors signalizing problems with either hostname verification, NameConstaints standard extension or IP Address Delegation extension.
Relevant links: NameConstaints extension (RFC 5280), IP Address Delegation extension (RFC 3779), Certificate Common Name (RFC 5280)
(No detailed documentation provided by the library.)
Original error message:
javax.net.ssl.SSLHandshakeException: No name matching (source)
Example certificates
Below you can download one or more example malformed certificates causing NO_NAME_MATCHING in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case host-no-match-cn (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing NO_NAME_MATCHING in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
- GnuTLS: GNUTLS_CERT_UNEXPECTED_OWNER
- Botan: CERT_NAME_NOMATCH
- Mbed TLS: MBEDTLS_X509_BADCERT_CN_MISMATCH
(No detailed documentation provided by the library.)
Original error message:
java.security.cert.CertPathValidatorException: name constraints check failed (source)
Example certificates
Below you can download one or more example malformed certificates causing NAME_CONSTRAINTS_CHECK_FAILED in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case nc-permitted-violation (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing NAME_CONSTRAINTS_CHECK_FAILED in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
Usage and policy errors
Errors related to standard extensions CertificatePolicies, KeyUsage and ExtendedKeyUsage.
Relevant links: KeyUsage extension (RFC5280), ExtendedKeyUsage extension (RFC5280), CertificatePolicies extension (RFC5280)
(No detailed documentation provided by the library.)
Original error message:
javax.net.ssl.SSLHandshakeException: Extended key usage does not permit use for TLS server authentication (source)
Example certificates
Below you can download one or more example malformed certificates causing EXT_KEY_USAGE_NO_TLS_SERVER in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case empty-ext-key-usage (see the generation script)
- Case unknown-ext-key-usage (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing EXT_KEY_USAGE_NO_TLS_SERVER in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
(No detailed documentation provided by the library.)
Original error message:
java.security.cert.CertPathValidatorException: CA key usage check failed (source)
Example certificates
Below you can download one or more example malformed certificates causing CA_KEY_USAGE_FAILED in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case no-certsign-in-keyusage (see the generation script)
- Case proxy-length-exceeded (see the generation script)
- Case proxy-name-no-match-issuer (see the generation script)
- Case proxy-with-san (see the generation script)
- Case valid-proxy (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing CA_KEY_USAGE_FAILED in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
- OpenSSL: X509_V_ERR_INVALID_CA, X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED, X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION, X509_V_ERR_UNSPECIFIED, X509_V_OK
- GnuTLS: GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE, GNUTLS_CERT_SIGNER_NOT_CA, GNUTLS_CERT_UNEXPECTED_OWNER
- Botan: CA_CERT_NOT_FOR_CERT_ISSUER, UNKNOWN_CRITICAL_EXTENSION
- Mbed TLS: MBEDTLS_X509_BADCERT_NOT_TRUSTED, MBEDTLS_ERR_X509_INVALID_EXTENSIONS
Algorithm related errors
Various errors signalizing usage of invalid or deprecated algorithms.
Relevant links: Algorithm and Key Size Profile for PKI (RFC 7935), Suite B Profile for TLS (RFC 6460)
(No detailed documentation provided by the library.)
Original error message:
java.security.cert.CertPathValidatorException: Algorithm constraints check failed on keysize limits. (source)
(No detailed documentation provided by the library.)
Original error message:
java.security.cert.CertPathValidatorException: Algorithm constraints check failed on signature algorithm (source)
Example certificates
Below you can download one or more example malformed certificates causing FAILED_SIGNATURE_ALGORITHM in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case issuer-hash-md5 (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing FAILED_SIGNATURE_ALGORITHM in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
- OpenSSL: X509_V_ERR_CA_MD_TOO_WEAK
- GnuTLS: GNUTLS_CERT_INSECURE_ALGORITHM
- Botan: UNTRUSTED_HASH
- Mbed TLS: MBEDTLS_X509_BADCERT_BAD_MD
(No detailed documentation provided by the library.)
Original error message:
javax.net.ssl.SSLException: Unsupported signature algorithm (source)
Example certificates
Below you can download one or more example malformed certificates causing UNSUPPORTED_SIGNATURE_ALGORITHM in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case pubkey-info-invalid-oid (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing UNSUPPORTED_SIGNATURE_ALGORITHM in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
- OpenSSL: X509_V_ERR_EE_KEY_TOO_SMALL
- GnuTLS: GNUTLS_E_CERTIFICATE_ERROR
- Botan: DECODING_ERROR
Formatting errors
These errors occur when a field of the certificate/CRL contains invalid values or is badly formatted.
Relevant links: Certificate Signature (RFC 5280), Certificate Time formatting (RFC 5280), Certificate Signature Algorithm (RFC 5280)
(No detailed documentation provided by the library.)
Original error message:
javax.net.ssl.SSLHandshakeException: Failed to parse server certificates (source)
Example certificates
Below you can download one or more example malformed certificates causing FAILED_TO_PARSE_SERVER_CERTIFICATES in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case duplicate-bc-extension (see the generation script)
- Case empty-subject-and-no-san (see the generation script)
- Case notafter-field-invalid (see the generation script)
- Case notbefore-field-invalid (see the generation script)
- Case san-empty-email (see the generation script)
- Case v1-cert-with-extensions (see the generation script)
- Case v4-cert (see the generation script)
- Case wrong-signature-algorithm (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing FAILED_TO_PARSE_SERVER_CERTIFICATES in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
- OpenSSL: X509_V_ERR_UNSPECIFIED, X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD, X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD, X509_V_ERR_UNSUPPORTED_NAME_SYNTAX, X509_V_ERR_EXTENSIONS_REQUIRE_VERSION_3, X509_V_OK, X509_V_ERR_CERT_SIGNATURE_FAILURE
- GnuTLS: GNUTLS_E_CERTIFICATE_ERROR, GNUTLS_CERT_UNEXPECTED_OWNER, GNUTLS_E_ASN1_DER_ERROR, GNUTLS_E_SUCCESS
- Botan: DUPLICATE_CERT_EXTENSION, CERT_NAME_NOMATCH, VERIFIED, TLS_EXCEPTION, DECODING_ERROR
- Mbed TLS: MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_X509_BADCERT_CN_MISMATCH, MBEDTLS_ERR_X509_INVALID_DATE, MBEDTLS_ERR_X509_INVALID_FORMAT, MBEDTLS_ERR_X509_SIG_MISMATCH
(No detailed documentation provided by the library.)
Original error message:
java.security.cert.CertPathValidatorException: incorrect KeyUsage extension bits (source)
(No detailed documentation provided by the library.)
Original error message:
java.security.cert.CertPathValidatorException: signature check failed (source)
Example certificates
Below you can download one or more example malformed certificates causing SIGNATURE_CHECK_FAILED in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case invalid-signature (see the generation script)
- Case issuer-pubkey-info-invalid-oid (see the generation script)
- Case issuer-pubkey-invalid-oid-and-signature (see the generation script)
- Case signature-algorithm-mismatch (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing SIGNATURE_CHECK_FAILED in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
(No detailed documentation provided by the library.)
Original error message:
java.io.IOException: Maximum BaseDistance in name constraints not supported (source)
Example certificates
Below you can download one or more example malformed certificates causing MAXIMUM_NAME_CONSTRAINTS in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case nc-maximum-present (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing MAXIMUM_NAME_CONSTRAINTS in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
(No detailed documentation provided by the library.)
Original error message:
java.io.IOException: Non-zero minimum BaseDistance in name constraints not supported (source)
Example certificates
Below you can download one or more example malformed certificates causing MINIMUM_NAME_CONSTRAINTS in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case nc-minimum-not-zero (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing MINIMUM_NAME_CONSTRAINTS in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
(No detailed documentation provided by the library.)
Original error message:
javax.net.ssl.SSLProtocolException: Unsupported handshake message (source)
Example certificates
Below you can download one or more example malformed certificates causing UNSUPPORTED_HANDSHAKE_MESSAGE in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case nc-unknown-name-type (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing UNSUPPORTED_HANDSHAKE_MESSAGE in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
Uncategorized errors
These errors are not yet categorized, deprecated or not used at all.
(No detailed documentation provided by the library.)
Original error message:
javax.net.ssl.SSLHandshakeException: PKIX path validation failed (source)
Example certificates
Below you can download one or more example malformed certificates causing PKIX_PATH_VALIDATION_FAILED in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case bc-path-len-exceeded (see the generation script)
- Case empty-ip-addr-blocks (see the generation script)
- Case expired (see the generation script)
- Case invalid-signature (see the generation script)
- Case ip-addr-blocks-no-subset (see the generation script)
- Case issuer-ca-false (see the generation script)
- Case issuer-hash-md5 (see the generation script)
- Case issuer-pubkey-info-invalid-oid (see the generation script)
- Case issuer-pubkey-invalid-oid-and-signature (see the generation script)
- Case nc-maximum-present (see the generation script)
- Case nc-minimum-not-zero (see the generation script)
- Case nc-permitted-violation (see the generation script)
- Case no-certsign-in-keyusage (see the generation script)
- Case not-yet-valid (see the generation script)
- Case proxy-ca (see the generation script)
- Case proxy-length-exceeded (see the generation script)
- Case proxy-name-no-match-issuer (see the generation script)
- Case proxy-with-san (see the generation script)
- Case signature-algorithm-mismatch (see the generation script)
- Case unknown-critical-extension (see the generation script)
- Case valid-proxy (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing PKIX_PATH_VALIDATION_FAILED in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
- OpenSSL: X509_V_ERR_PATH_LENGTH_EXCEEDED, X509_V_ERR_INVALID_EXTENSION, X509_V_ERR_CERT_HAS_EXPIRED, X509_V_ERR_CERT_SIGNATURE_FAILURE, X509_V_ERR_UNNESTED_RESOURCE, X509_V_ERR_INVALID_CA, X509_V_ERR_CA_MD_TOO_WEAK, X509_V_ERR_NO_ISSUER_PUBLIC_KEY, X509_V_ERR_SUBTREE_MINMAX, X509_V_ERR_PERMITTED_VIOLATION, X509_V_ERR_CERT_NOT_YET_VALID, X509_V_ERR_INVALID_NON_CA, X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED, X509_V_ERR_PROXY_SUBJECT_NAME_VIOLATION, X509_V_ERR_UNSPECIFIED, X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION, X509_V_OK
- GnuTLS: GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE, GNUTLS_CERT_UNKNOWN_CRIT_EXTENSIONS, GNUTLS_CERT_EXPIRED, GNUTLS_CERT_SIGNATURE_FAILURE, GNUTLS_CERT_SIGNER_NOT_CA, GNUTLS_CERT_INSECURE_ALGORITHM, GNUTLS_E_CERTIFICATE_ERROR, GNUTLS_CERT_UNEXPECTED_OWNER, GNUTLS_CERT_NOT_ACTIVATED, GNUTLS_E_SUCCESS
- Botan: CERT_CHAIN_TOO_LONG, UNKNOWN_CRITICAL_EXTENSION, CERT_HAS_EXPIRED, SIGNATURE_ERROR, CA_CERT_NOT_FOR_CERT_ISSUER, UNTRUSTED_HASH, TLS_EXCEPTION, NAME_CONSTRAINT_ERROR, CERT_NOT_YET_VALID, VERIFIED
- Mbed TLS: MBEDTLS_X509_BADCERT_NOT_TRUSTED, MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_X509_BADCERT_EXPIRED, MBEDTLS_X509_BADCERT_BAD_MD, MBEDTLS_X509_BADCERT_FUTURE
(No detailed documentation provided by the library.)
Original error message:
ok (source)
Example certificates
Below you can download one or more example malformed certificates causing NO_MESSAGE in OpenJDK. If you are interested in generating these certificates yourself, see the corresponding generating script for each case on the project Github.
- Case any-ext-key-usage (see the generation script)
- Case bc-not-critical-ca (see the generation script)
- Case bc-path-len-in-non-ca (see the generation script)
- Case bc-path-len-negative (see the generation script)
- Case cert_revoked (see the generation script)
- Case crl_has_expired (see the generation script)
- Case crl_not_yet_valid (see the generation script)
- Case crl_path_validation_error (see the generation script)
- Case crl_signature_failure (see the generation script)
- Case different_crl_scope (see the generation script)
- Case end-entity-rsa-key-1024 (see the generation script)
- Case error_in_crl_last_update_field (see the generation script)
- Case error_in_crl_next_update_field (see the generation script)
- Case issuer-rsa-key-1024 (see the generation script)
- Case keyusage_no_crl_sign (see the generation script)
- Case nc-empty (see the generation script)
- Case nc-excluded-violation (see the generation script)
- Case negative-serial-number (see the generation script)
- Case no-key-usage-in-ca (see the generation script)
- Case san-null-byte-in-email (see the generation script)
- Case trusted-only-intermediate (see the generation script)
- Case unable_to_get_crl (see the generation script)
- Case unhandled_critical_crl_extension (see the generation script)
- Case valid-with-aia (see the generation script)
- Case valid-with-crldp (see the generation script)
- Case valid (see the generation script)
Corresponding errors
What validation errors do other libraries give for certificates causing NO_MESSAGE in OpenJDK? Below, you can see the basic overview based on the example certificates from the previous section. (The list may be incomplete.)
- OpenSSL: X509_V_ERR_INVALID_PURPOSE, X509_V_ERR_CA_BCONS_NOT_CRITICAL, X509_V_ERR_PATHLEN_WITHOUT_KU_KEY_CERT_SIGN, X509_V_ERR_UNSPECIFIED, X509_V_ERR_CERT_REVOKED, X509_V_ERR_CRL_HAS_EXPIRED, X509_V_ERR_CRL_NOT_YET_VALID, X509_V_ERR_CRL_PATH_VALIDATION_ERROR, X509_V_ERR_CRL_SIGNATURE_FAILURE, X509_V_ERR_EE_KEY_TOO_SMALL, X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD, X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD, X509_V_ERR_CA_KEY_TOO_SMALL, X509_V_ERR_KEYUSAGE_NO_CRL_SIGN, X509_V_OK, X509_V_ERR_EXCLUDED_VIOLATION, X509_V_ERR_CA_CERT_MISSING_KEY_USAGE, X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT, X509_V_ERR_UNABLE_TO_GET_CRL, X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION
- GnuTLS: GNUTLS_E_SUCCESS, GNUTLS_CERT_INSECURE_ALGORITHM, GNUTLS_CERT_UNEXPECTED_OWNER, GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE
- Botan: INVALID_USAGE, VERIFIED, UNKNOWN_CRITICAL_EXTENSION, TLS_EXCEPTION, SIGNATURE_METHOD_TOO_WEAK, ENCODING_ERROR, CERT_ISSUER_NOT_FOUND
- Mbed TLS: MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_X509_BADCERT_BAD_KEY
About the project
The project is developed at the Centre for Research on Cryptography and Security (CRoCS) at Masaryk University, Brno, Czech Republic by Martin Ukrop, Pavol Žáčik, Marián Svitek, Eric Valčík with the help of Michaela Balážová and Matěj Grabovský. For more details, see the ReadMe file in the project repository on GitHub.
The authors are grateful for the financial support by Red Hat Czech and Kiwi.com.