1 // Copyright 2017 The Chromium Authors
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 //     https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 
15 #ifndef BSSL_PKI_COMMON_CERT_ERRORS_H_
16 #define BSSL_PKI_COMMON_CERT_ERRORS_H_
17 
18 #include <openssl/base.h>
19 
20 #include "cert_errors.h"
21 
22 // This file contains the set of "default" certificate errors (those
23 // defined by the core verification/path building code).
24 //
25 // Errors may be defined for other domains.
26 BSSL_NAMESPACE_BEGIN
27 namespace cert_errors {
28 
29 // An internal error occurred which prevented path building or verification
30 // from finishing.
31 OPENSSL_EXPORT extern const CertErrorId kInternalError;
32 
33 // The verification time is after the certificate's notAfter time.
34 OPENSSL_EXPORT extern const CertErrorId kValidityFailedNotAfter;
35 
36 // The verification time is before the certificate's notBefore time.
37 OPENSSL_EXPORT extern const CertErrorId kValidityFailedNotBefore;
38 
39 // The certificate is actively distrusted by the trust store (this is separate
40 // from other revocation mechanisms).
41 OPENSSL_EXPORT extern const CertErrorId kDistrustedByTrustStore;
42 
43 // The certificate disagrees on what the signature algorithm was
44 // (Certificate.signatureAlgorithm != TBSCertificate.signature).
45 OPENSSL_EXPORT extern const CertErrorId kSignatureAlgorithmMismatch;
46 
47 // Certificate verification was called with an empty chain.
48 OPENSSL_EXPORT extern const CertErrorId kChainIsEmpty;
49 
50 // The certificate contains an unknown extension which is marked as critical.
51 OPENSSL_EXPORT extern const CertErrorId kUnconsumedCriticalExtension;
52 
53 // The target certificate appears to be a CA (has Basic Constraints CA=true)
54 // but is being used for TLS client or server authentication.
55 OPENSSL_EXPORT extern const CertErrorId kTargetCertShouldNotBeCa;
56 
57 // The certificate is being used to sign other certificates, however the
58 // keyCertSign KeyUsage was not set.
59 OPENSSL_EXPORT extern const CertErrorId kKeyCertSignBitNotSet;
60 
61 // The certificate is being used for RCS MLS but the required digitalSignature
62 // bit was either not set, or was not the only bit set.
63 OPENSSL_EXPORT extern const CertErrorId kKeyUsageIncorrectForRcsMlsClient;
64 
65 // The chain violates the max_path_length from BasicConstraints.
66 OPENSSL_EXPORT extern const CertErrorId kMaxPathLengthViolated;
67 
68 // The certificate being used to sign other certificates has a
69 // BasicConstraints extension, however it sets CA=false
70 OPENSSL_EXPORT extern const CertErrorId kBasicConstraintsIndicatesNotCa;
71 
72 // The certificate being used to sign other certificates does not include a
73 // BasicConstraints extension.
74 OPENSSL_EXPORT extern const CertErrorId kMissingBasicConstraints;
75 
76 // The certificate has a subject or subjectAltName that violates an issuer's
77 // name constraints.
78 OPENSSL_EXPORT extern const CertErrorId kNotPermittedByNameConstraints;
79 
80 // The chain has an excessive number of names and/or name constraints.
81 OPENSSL_EXPORT extern const CertErrorId kTooManyNameConstraintChecks;
82 
83 // The certificate's issuer field does not match the subject of its alleged
84 // issuer.
85 OPENSSL_EXPORT extern const CertErrorId kSubjectDoesNotMatchIssuer;
86 
87 // Failed to verify the certificate's signature using its issuer's public key.
88 OPENSSL_EXPORT extern const CertErrorId kVerifySignedDataFailed;
89 
90 // The certificate encodes its signature differently between
91 // Certificate.algorithm and TBSCertificate.signature, but it appears
92 // to be the same algorithm.
93 OPENSSL_EXPORT extern const CertErrorId kSignatureAlgorithmsDifferentEncoding;
94 
95 // The certificate verification is being done for serverAuth, however the
96 // certificate lacks serverAuth in its ExtendedKeyUsages.
97 OPENSSL_EXPORT extern const CertErrorId kEkuLacksServerAuth;
98 
99 // The certificate verification is being done for clientAuth, however the
100 // certificate lacks clientAuth in its ExtendedKeyUsages.
101 OPENSSL_EXPORT extern const CertErrorId kEkuLacksClientAuth;
102 
103 // The root certificate in a chain is not trusted.
104 OPENSSL_EXPORT extern const CertErrorId kCertIsNotTrustAnchor;
105 
106 // The chain is not valid for any policy, and an explicit policy was required.
107 // (Either because the relying party requested it during verificaiton, or it was
108 // requrested by a PolicyConstraints extension).
109 OPENSSL_EXPORT extern const CertErrorId kNoValidPolicy;
110 
111 // The certificate is trying to map to, or from, anyPolicy.
112 OPENSSL_EXPORT extern const CertErrorId kPolicyMappingAnyPolicy;
113 
114 // The public key in this certificate could not be parsed.
115 OPENSSL_EXPORT extern const CertErrorId kFailedParsingSpki;
116 
117 // The certificate's signature algorithm (used to verify its
118 // signature) is not acceptable by the consumer. What constitutes as
119 // "acceptable" is determined by the verification delegate.
120 OPENSSL_EXPORT extern const CertErrorId kUnacceptableSignatureAlgorithm;
121 
122 // The certificate's public key is not acceptable by the consumer.
123 // What constitutes as "acceptable" is determined by the verification delegate.
124 OPENSSL_EXPORT extern const CertErrorId kUnacceptablePublicKey;
125 
126 // The certificate's EKU is missing serverAuth. However EKU ANY is present
127 // instead.
128 OPENSSL_EXPORT extern const CertErrorId kEkuLacksServerAuthButHasAnyEKU;
129 
130 // The certificate's EKU is missing clientAuth. However EKU ANY is present
131 // instead.
132 OPENSSL_EXPORT extern const CertErrorId kEkuLacksClientAuthButHasAnyEKU;
133 
134 // The certificate's EKU is missing both clientAuth and serverAuth.
135 OPENSSL_EXPORT extern const CertErrorId kEkuLacksClientAuthOrServerAuth;
136 
137 // The certificate's EKU has OSCP Signing when it should not.
138 OPENSSL_EXPORT extern const CertErrorId kEkuHasProhibitedOCSPSigning;
139 
140 // The certificate's EKU has Time Stamping when it should not.
141 OPENSSL_EXPORT extern const CertErrorId kEkuHasProhibitedTimeStamping;
142 
143 // The certificate's EKU has Code Signing when it should not.
144 OPENSSL_EXPORT extern const CertErrorId kEkuHasProhibitedCodeSigning;
145 
146 // The certificate's EKU is incorrect for an RcsMlsClient.
147 OPENSSL_EXPORT extern const CertErrorId kEkuIncorrectForRcsMlsClient;
148 
149 // The certificate's EKU is incorrect for C2PA Time Stamping
150 OPENSSL_EXPORT extern const CertErrorId kEkuIncorrectForC2PATimeStamping;
151 
152 // The certificate's EKU is incorrect for C2PA Manifest Signing
153 OPENSSL_EXPORT extern const CertErrorId kEkuIncorrectForC2PAManifest;
154 
155 // The certificate does not have EKU.
156 OPENSSL_EXPORT extern const CertErrorId kEkuNotPresent;
157 
158 // The certificate has been revoked.
159 OPENSSL_EXPORT extern const CertErrorId kCertificateRevoked;
160 
161 // The certificate lacks a recognized revocation mechanism (i.e. OCSP/CRL).
162 // Emitted as an error when revocation checking expects certificates to have
163 // such info.
164 OPENSSL_EXPORT extern const CertErrorId kNoRevocationMechanism;
165 
166 // The certificate had a revocation mechanism, but when used it was unable to
167 // affirmatively say whether the certificate was unrevoked.
168 OPENSSL_EXPORT extern const CertErrorId kUnableToCheckRevocation;
169 
170 // Path building was unable to find any issuers for the certificate.
171 OPENSSL_EXPORT extern const CertErrorId kNoIssuersFound;
172 
173 // Deadline was reached during path building.
174 OPENSSL_EXPORT extern const CertErrorId kDeadlineExceeded;
175 
176 // Iteration limit was reached during path building.
177 OPENSSL_EXPORT extern const CertErrorId kIterationLimitExceeded;
178 
179 // Depth limit was reached during path building.
180 OPENSSL_EXPORT extern const CertErrorId kDepthLimitExceeded;
181 
182 }  // namespace cert_errors
183 BSSL_NAMESPACE_END
184 
185 #endif  // BSSL_PKI_COMMON_CERT_ERRORS_H_
186