What do the different status error codes for the CheckValidationResult certificateProblem parameter stand for?

2

In the MSDN Example of the ICertificatePolicy interface, there is an enum which lists all the possible status error codes that can be returned via the ValidationCallback:

public enum CertificateProblem : long
{
        CertEXPIRED                   = 0x800B0101,
        CertVALIDITYPERIODNESTING     = 0x800B0102,
        CertROLE                      = 0x800B0103,
        CertPATHLENCONST              = 0x800B0104,
        CertCRITICAL                  = 0x800B0105,
        CertPURPOSE                   = 0x800B0106,
        CertISSUERCHAINING            = 0x800B0107,
        CertMALFORMED                 = 0x800B0108,
        CertUNTRUSTEDROOT             = 0x800B0109,
        CertCHAINING                  = 0x800B010A,
        CertREVOKED                   = 0x800B010C,
        CertUNTRUSTEDTESTROOT         = 0x800B010D,
        CertREVOCATION_FAILURE        = 0x800B010E,
        CertCN_NO_MATCH               = 0x800B010F,
        CertWRONG_USAGE               = 0x800B0110,
        CertUNTRUSTEDCA               = 0x800B0112
}

What do these different status codes stand for? They are not in the SSPI Status Code document that the links reference.

c#
ssl
certificate
asked on Stack Overflow May 10, 2013 by John Leehey

1 Answer

4

I spent a long time trying to figure this out, and was finally able to find a VMware C# file containing explanations of the different codes:

CertEXPIRED
A required certificate is not within its validity period

CertVALIDITYPERIODNESTING
The validity periods of the certification chain do not nest correctly

CertROLE
A certificate that can only be used as an end-entity is being used as a CA or visa versa

CertPATHLENCONST
A path length constraint in the certification chain has been violated

CertCRITICAL
An extension of unknown type that is labeled 'critical' is present in a certificate

CertPURPOSE
A certificate is being used for a purpose other than that for which it is permitted

CertISSUERCHAINING
A parent of a given certificate in fact did not issue that child certificate

CertMALFORMED
A certificate is missing or has an empty value for an important field, such as a subject or issuer name

CertUNTRUSTEDROOT
A certification chain processed correctly, but terminated in a root certificate which isn't trusted by the trust provider

CertCHAINING
A chain of certs didn't chain as they should in a certain application of chaining

CertREVOKED
A certificate was explicitly revoked by its issuer

CertUNTRUSTEDTESTROOT
The root certificate is a testing certificate and the policy settings disallow test certificates

CertREVOCATION_FAILURE
The revocation process could not continue - the certificate(s) could not be checked

CertCN_NO_MATCH
The certificate's CN name does not match the passed value

CertWRONG_USAGE
The certificate is not valid for the requested usage

CertUNTRUSTEDCA
Untrusted CA

answered on Stack Overflow May 10, 2013 by John Leehey

User contributions licensed under CC BY-SA 3.0