1 // Copyright 2017 The Chromium Authors 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // https://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 #ifndef BSSL_PKI_COMMON_CERT_ERRORS_H_ 16 #define BSSL_PKI_COMMON_CERT_ERRORS_H_ 17 18 #include <openssl/base.h> 19 20 #include "cert_errors.h" 21 22 // This file contains the set of "default" certificate errors (those 23 // defined by the core verification/path building code). 24 // 25 // Errors may be defined for other domains. 26 BSSL_NAMESPACE_BEGIN 27 namespace cert_errors { 28 29 // An internal error occurred which prevented path building or verification 30 // from finishing. 31 OPENSSL_EXPORT extern const CertErrorId kInternalError; 32 33 // The verification time is after the certificate's notAfter time. 34 OPENSSL_EXPORT extern const CertErrorId kValidityFailedNotAfter; 35 36 // The verification time is before the certificate's notBefore time. 37 OPENSSL_EXPORT extern const CertErrorId kValidityFailedNotBefore; 38 39 // The certificate is actively distrusted by the trust store (this is separate 40 // from other revocation mechanisms). 41 OPENSSL_EXPORT extern const CertErrorId kDistrustedByTrustStore; 42 43 // The certificate disagrees on what the signature algorithm was 44 // (Certificate.signatureAlgorithm != TBSCertificate.signature). 45 OPENSSL_EXPORT extern const CertErrorId kSignatureAlgorithmMismatch; 46 47 // Certificate verification was called with an empty chain. 48 OPENSSL_EXPORT extern const CertErrorId kChainIsEmpty; 49 50 // The certificate contains an unknown extension which is marked as critical. 51 OPENSSL_EXPORT extern const CertErrorId kUnconsumedCriticalExtension; 52 53 // The target certificate appears to be a CA (has Basic Constraints CA=true) 54 // but is being used for TLS client or server authentication. 55 OPENSSL_EXPORT extern const CertErrorId kTargetCertShouldNotBeCa; 56 57 // The certificate is being used to sign other certificates, however the 58 // keyCertSign KeyUsage was not set. 59 OPENSSL_EXPORT extern const CertErrorId kKeyCertSignBitNotSet; 60 61 // The certificate is being used for RCS MLS but the required digitalSignature 62 // bit was either not set, or was not the only bit set. 63 OPENSSL_EXPORT extern const CertErrorId kKeyUsageIncorrectForRcsMlsClient; 64 65 // The chain violates the max_path_length from BasicConstraints. 66 OPENSSL_EXPORT extern const CertErrorId kMaxPathLengthViolated; 67 68 // The certificate being used to sign other certificates has a 69 // BasicConstraints extension, however it sets CA=false 70 OPENSSL_EXPORT extern const CertErrorId kBasicConstraintsIndicatesNotCa; 71 72 // The certificate being used to sign other certificates does not include a 73 // BasicConstraints extension. 74 OPENSSL_EXPORT extern const CertErrorId kMissingBasicConstraints; 75 76 // The certificate has a subject or subjectAltName that violates an issuer's 77 // name constraints. 78 OPENSSL_EXPORT extern const CertErrorId kNotPermittedByNameConstraints; 79 80 // The chain has an excessive number of names and/or name constraints. 81 OPENSSL_EXPORT extern const CertErrorId kTooManyNameConstraintChecks; 82 83 // The certificate's issuer field does not match the subject of its alleged 84 // issuer. 85 OPENSSL_EXPORT extern const CertErrorId kSubjectDoesNotMatchIssuer; 86 87 // Failed to verify the certificate's signature using its issuer's public key. 88 OPENSSL_EXPORT extern const CertErrorId kVerifySignedDataFailed; 89 90 // The certificate encodes its signature differently between 91 // Certificate.algorithm and TBSCertificate.signature, but it appears 92 // to be the same algorithm. 93 OPENSSL_EXPORT extern const CertErrorId kSignatureAlgorithmsDifferentEncoding; 94 95 // The certificate verification is being done for serverAuth, however the 96 // certificate lacks serverAuth in its ExtendedKeyUsages. 97 OPENSSL_EXPORT extern const CertErrorId kEkuLacksServerAuth; 98 99 // The certificate verification is being done for clientAuth, however the 100 // certificate lacks clientAuth in its ExtendedKeyUsages. 101 OPENSSL_EXPORT extern const CertErrorId kEkuLacksClientAuth; 102 103 // The root certificate in a chain is not trusted. 104 OPENSSL_EXPORT extern const CertErrorId kCertIsNotTrustAnchor; 105 106 // The chain is not valid for any policy, and an explicit policy was required. 107 // (Either because the relying party requested it during verificaiton, or it was 108 // requrested by a PolicyConstraints extension). 109 OPENSSL_EXPORT extern const CertErrorId kNoValidPolicy; 110 111 // The certificate is trying to map to, or from, anyPolicy. 112 OPENSSL_EXPORT extern const CertErrorId kPolicyMappingAnyPolicy; 113 114 // The public key in this certificate could not be parsed. 115 OPENSSL_EXPORT extern const CertErrorId kFailedParsingSpki; 116 117 // The certificate's signature algorithm (used to verify its 118 // signature) is not acceptable by the consumer. What constitutes as 119 // "acceptable" is determined by the verification delegate. 120 OPENSSL_EXPORT extern const CertErrorId kUnacceptableSignatureAlgorithm; 121 122 // The certificate's public key is not acceptable by the consumer. 123 // What constitutes as "acceptable" is determined by the verification delegate. 124 OPENSSL_EXPORT extern const CertErrorId kUnacceptablePublicKey; 125 126 // The certificate's EKU is missing serverAuth. However EKU ANY is present 127 // instead. 128 OPENSSL_EXPORT extern const CertErrorId kEkuLacksServerAuthButHasAnyEKU; 129 130 // The certificate's EKU is missing clientAuth. However EKU ANY is present 131 // instead. 132 OPENSSL_EXPORT extern const CertErrorId kEkuLacksClientAuthButHasAnyEKU; 133 134 // The certificate's EKU is missing both clientAuth and serverAuth. 135 OPENSSL_EXPORT extern const CertErrorId kEkuLacksClientAuthOrServerAuth; 136 137 // The certificate's EKU has OSCP Signing when it should not. 138 OPENSSL_EXPORT extern const CertErrorId kEkuHasProhibitedOCSPSigning; 139 140 // The certificate's EKU has Time Stamping when it should not. 141 OPENSSL_EXPORT extern const CertErrorId kEkuHasProhibitedTimeStamping; 142 143 // The certificate's EKU has Code Signing when it should not. 144 OPENSSL_EXPORT extern const CertErrorId kEkuHasProhibitedCodeSigning; 145 146 // The certificate's EKU is incorrect for an RcsMlsClient. 147 OPENSSL_EXPORT extern const CertErrorId kEkuIncorrectForRcsMlsClient; 148 149 // The certificate's EKU is incorrect for C2PA Time Stamping 150 OPENSSL_EXPORT extern const CertErrorId kEkuIncorrectForC2PATimeStamping; 151 152 // The certificate's EKU is incorrect for C2PA Manifest Signing 153 OPENSSL_EXPORT extern const CertErrorId kEkuIncorrectForC2PAManifest; 154 155 // The certificate does not have EKU. 156 OPENSSL_EXPORT extern const CertErrorId kEkuNotPresent; 157 158 // The certificate has been revoked. 159 OPENSSL_EXPORT extern const CertErrorId kCertificateRevoked; 160 161 // The certificate lacks a recognized revocation mechanism (i.e. OCSP/CRL). 162 // Emitted as an error when revocation checking expects certificates to have 163 // such info. 164 OPENSSL_EXPORT extern const CertErrorId kNoRevocationMechanism; 165 166 // The certificate had a revocation mechanism, but when used it was unable to 167 // affirmatively say whether the certificate was unrevoked. 168 OPENSSL_EXPORT extern const CertErrorId kUnableToCheckRevocation; 169 170 // Path building was unable to find any issuers for the certificate. 171 OPENSSL_EXPORT extern const CertErrorId kNoIssuersFound; 172 173 // Deadline was reached during path building. 174 OPENSSL_EXPORT extern const CertErrorId kDeadlineExceeded; 175 176 // Iteration limit was reached during path building. 177 OPENSSL_EXPORT extern const CertErrorId kIterationLimitExceeded; 178 179 // Depth limit was reached during path building. 180 OPENSSL_EXPORT extern const CertErrorId kDepthLimitExceeded; 181 182 } // namespace cert_errors 183 BSSL_NAMESPACE_END 184 185 #endif // BSSL_PKI_COMMON_CERT_ERRORS_H_ 186