1 /* $OpenBSD: x509_txt.c,v 1.28 2023/02/16 08:38:17 tb Exp $ */ 2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58 59 #include <openssl/x509_vfy.h> 60 61 const char * 62 X509_verify_cert_error_string(long n) 63 { 64 switch ((int)n) { 65 case X509_V_OK: 66 return "ok"; 67 case X509_V_ERR_UNSPECIFIED: 68 return "Unspecified certificate verification error"; 69 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: 70 return "unable to get issuer certificate"; 71 case X509_V_ERR_UNABLE_TO_GET_CRL: 72 return "unable to get certificate CRL"; 73 case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE: 74 return "unable to decrypt certificate's signature"; 75 case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE: 76 return "unable to decrypt CRL's signature"; 77 case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY: 78 return "unable to decode issuer public key"; 79 case X509_V_ERR_CERT_SIGNATURE_FAILURE: 80 return "certificate signature failure"; 81 case X509_V_ERR_CRL_SIGNATURE_FAILURE: 82 return "CRL signature failure"; 83 case X509_V_ERR_CERT_NOT_YET_VALID: 84 return "certificate is not yet valid"; 85 case X509_V_ERR_CERT_HAS_EXPIRED: 86 return "certificate has expired"; 87 case X509_V_ERR_CRL_NOT_YET_VALID: 88 return "CRL is not yet valid"; 89 case X509_V_ERR_CRL_HAS_EXPIRED: 90 return "CRL has expired"; 91 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: 92 return "format error in certificate's notBefore field"; 93 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: 94 return "format error in certificate's notAfter field"; 95 case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD: 96 return "format error in CRL's lastUpdate field"; 97 case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD: 98 return "format error in CRL's nextUpdate field"; 99 case X509_V_ERR_OUT_OF_MEM: 100 return "out of memory"; 101 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: 102 return "self signed certificate"; 103 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: 104 return "self signed certificate in certificate chain"; 105 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: 106 return "unable to get local issuer certificate"; 107 case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: 108 return "unable to verify the first certificate"; 109 case X509_V_ERR_CERT_CHAIN_TOO_LONG: 110 return "certificate chain too long"; 111 case X509_V_ERR_CERT_REVOKED: 112 return "certificate revoked"; 113 case X509_V_ERR_INVALID_CA: 114 return "invalid CA certificate"; 115 case X509_V_ERR_PATH_LENGTH_EXCEEDED: 116 return "path length constraint exceeded"; 117 case X509_V_ERR_INVALID_PURPOSE: 118 return "unsupported certificate purpose"; 119 case X509_V_ERR_CERT_UNTRUSTED: 120 return "certificate not trusted"; 121 case X509_V_ERR_CERT_REJECTED: 122 return "certificate rejected"; 123 case X509_V_ERR_SUBJECT_ISSUER_MISMATCH: 124 return "subject issuer mismatch"; 125 case X509_V_ERR_AKID_SKID_MISMATCH: 126 return "authority and subject key identifier mismatch"; 127 case X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH: 128 return "authority and issuer serial number mismatch"; 129 case X509_V_ERR_KEYUSAGE_NO_CERTSIGN: 130 return "key usage does not include certificate signing"; 131 case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER: 132 return "unable to get CRL issuer certificate"; 133 case X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION: 134 return "unhandled critical extension"; 135 case X509_V_ERR_KEYUSAGE_NO_CRL_SIGN: 136 return "key usage does not include CRL signing"; 137 case X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION: 138 return "unhandled critical CRL extension"; 139 case X509_V_ERR_INVALID_NON_CA: 140 return "invalid non-CA certificate (has CA markings)"; 141 case X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED: 142 return "proxy path length constraint exceeded"; 143 case X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE: 144 return "key usage does not include digital signature"; 145 case X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED: 146 return "proxy certificates not allowed, " 147 "please set the appropriate flag"; 148 case X509_V_ERR_INVALID_EXTENSION: 149 return "invalid or inconsistent certificate extension"; 150 case X509_V_ERR_INVALID_POLICY_EXTENSION: 151 return "invalid or inconsistent certificate policy extension"; 152 case X509_V_ERR_NO_EXPLICIT_POLICY: 153 return "no explicit policy"; 154 case X509_V_ERR_DIFFERENT_CRL_SCOPE: 155 return "Different CRL scope"; 156 case X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE: 157 return "Unsupported extension feature"; 158 case X509_V_ERR_UNNESTED_RESOURCE: 159 return "RFC 3779 resource not subset of parent's resources"; 160 case X509_V_ERR_PERMITTED_VIOLATION: 161 return "permitted subtree violation"; 162 case X509_V_ERR_EXCLUDED_VIOLATION: 163 return "excluded subtree violation"; 164 case X509_V_ERR_SUBTREE_MINMAX: 165 return "name constraints minimum and maximum not supported"; 166 case X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE: 167 return "unsupported name constraint type"; 168 case X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: 169 return "unsupported or invalid name constraint syntax"; 170 case X509_V_ERR_UNSUPPORTED_NAME_SYNTAX: 171 return "unsupported or invalid name syntax"; 172 case X509_V_ERR_CRL_PATH_VALIDATION_ERROR: 173 return "CRL path validation error"; 174 case X509_V_ERR_APPLICATION_VERIFICATION: 175 return "application verification failure"; 176 case X509_V_ERR_HOSTNAME_MISMATCH: 177 return "Hostname mismatch"; 178 case X509_V_ERR_EMAIL_MISMATCH: 179 return "Email address mismatch"; 180 case X509_V_ERR_IP_ADDRESS_MISMATCH: 181 return "IP address mismatch"; 182 case X509_V_ERR_INVALID_CALL: 183 return "Invalid certificate verification context"; 184 case X509_V_ERR_STORE_LOOKUP: 185 return "Issuer certificate lookup error"; 186 case X509_V_ERR_EE_KEY_TOO_SMALL: 187 return "EE certificate key too weak"; 188 case X509_V_ERR_CA_KEY_TOO_SMALL: 189 return "CA certificate key too weak"; 190 case X509_V_ERR_CA_MD_TOO_WEAK: 191 return "CA signature digest algorithm too weak"; 192 default: 193 return "Unknown certificate verification error"; 194 } 195 } 196 LCRYPTO_ALIAS(X509_verify_cert_error_string); 197