- @TIME@
- @IP@
- @CLIENTID@
- @RECORD_ID@
- @INSTANCE_ID@
- @VERSION@
-
@URL@
-
@STATUS_PHRASE@
-
Event Type | @REASON@
- A failure in the SSL library occurred, usually a protocol error.
- This error typically indicates an issue with the SSL protocol itself, such as a mismatch in protocol versions or cipher suites between the client and server.
- The TLS/SSL connection has been closed.
- This error signifies that the communication channel has been cleanly shut down, and no more data can be read or written.
- The operation did not complete; the same TLS/SSL I/O function should be called again later.
- This is a non-fatal error that occurs when a read operation needs to be retried, often due to incomplete data transmission.
- The operation did not complete; the same TLS/SSL I/O function should be called again later.
- Similar to SSL_ERROR_WANT_READ, this error occurs for write operations that need to be retried, usually because the underlying transport is not ready for writing.
- The connect I/O function failed; it should be called again later.
- This error occurs during a non-blocking SSL connect operation. The connect process needs to be called again to complete.
- The accept I/O function failed; it should be called again later.
- This error happens during a non-blocking SSL accept operation and indicates that the operation should be retried later.
- The operation did not complete because an application callback set by SSL_CTX_set_client_cert_cb() has asked to be called again.
- This error is related to client certificate verification and occurs when a callback set for certificate verification requests to be called again.
- Some non-recoverable I/O error occurred.
- This error usually signifies an underlying issue at the system level, such as a broken pipe, socket error, or other I/O problem.
- A failure in the SSL handshake occurred.
- This error indicates a problem during the SSL/TLS handshake process, possibly due to certificate verification failure or protocol mismatch.
- A problem with the certificate (e.g., it is expired or not yet valid).
- This error occurs when there's an issue with a certificate, such as being expired, untrusted, or not matching the requested domain.
- Ok
- The operation was successful
- Unspecified
- An unspecified error occurred
- This error occurs when a specific error condition is not identified.
- Unable to get issuer certificate
- Issuer certificate of a locally looked up certificate could not be found
- Normally means the list of trusted certificates is not complete
- Unable to get certificate CRL
- The CRL of a certificate could not be found
- Unable to decrypt certificate's signature
- The certificate signature could not be decrypted: This means that the actual signature value could not be determined rather than it not matching the expected value, this is only meaningful for RSA keys
- Unable to decrypt CRL's signature
- The CRL signature could not be decrypted: this means that the actual signature value could not be determined rather than it not matching the expected value.
- Unused
- Unable to decode issuer public key
- The public key in the certificate SubjectPublicKeyInfo could not be read
- Certificate signature failure
- Signature of the certificate is invalid
- CRL signature failure
- The signature of the certificate is invalid
- Certificate is not yet valid
- The certificate is not yet valid: the notBefore date is after the current time
- Certificate has expired
- The certificate has expired: that is the notAfter date is before the current time
- CRL is not yet valid
- The CRL is not yet valid
- CRL has expired
- The CRL has expired
- Format error in certificate's notBefore field
- The certificate notBefore field contains an invalid time
- Format error in certificate's notAfter field
- The certificate notAfter field contains an invalid time
- Format error in CRL's lastUpdate field
- The CRL lastUpdate field contains an invalid time
- Format error in CRL's nextUpdate field
- The CRL nextUpdate field contains an invalid time
- Out of memory
- An error occurred trying to allocate memory
- This should never happen
- Self signed certificate
- The passed certificate is self signed and the same certificate cannot be found in the list of trusted certificates
- Self signed certificate in certificate chain
- The certificate chain could be built up using the untrusted certificates but the root could not be found locally
- Unable to get local issuer certificate
- The issuer certificate could not be found: this occurs if the issuer certificate of an untrusted certificate cannot be found
- Unable to verify the first certificate
- No signatures could be verified because the chain contains only one certificate and it is not self signed
- Certificate chain too long
- The certificate chain length is greater than the supplied maximum depth
- Unused
- Certificate revoked
- The certificate has been revoked
- Invalid CA certificate
- A CA certificate is invalid
- Either it is not a CA or its extensions are not consistent with the supplied purpose
- Path length constraint exceeded
- The basic Constraints path-length parameter has been exceeded
- Unsupported certificate purpose
- The supplied certificate cannot be used for the specified purpose
- Certificate not trusted
- The root CA is not marked as trusted for the specified purpose
- Certificate rejected
- The root CA is marked to reject the specified purpose
- Subject issuer mismatch
- The current candidate issuer certificate was rejected because its subject name did not match the issuer name of the current certificate
- This is only set if issuer check debugging is enabled it is used for status notification and is not in itself an error
- Authority and subject key identifier mismatch
- The current candidate issuer certificate was rejected because its subject key identifier was present and did not match the authority key identifier current certificate
- This is only set if issuer check debugging is enabled it is used for status notification and is not in itself an error
- Authority and issuer serial number mismatch
- The current candidate issuer certificate was rejected because its issuer name and serial number was present and did not match the authority key identifier of the current certificate
- This is only set if issuer check debugging is enabled it is used for status notification and is not in itself an error
- Key usage does not include certificate signing
- The current candidate issuer certificate was rejected because its keyUsage extension does not permit certificate signing
- This is only set if issuer check debugging is enabled it is used for status notification and is not in itself an error
- Unable to get CRL issuer
- This error indicates that the issuer of the Certificate Revocation List (CRL) for a certificate could not be found.
- It often suggests that the chain of trust for the CRL is incomplete or not properly established
- Unhandled critical extension
- This error occurs when a certificate contains a critical extension that is not recognized or handled
- This can affect the validation of the certificate
- Key usage does not include CRL signing
- This error signifies that the key usage of a certificate does not include CRL signing, which is necessary for certain operations
- Unhandled critical CRL extension
- This error indicates a Certificate Revocation List (CRL) contains a critical extension that is not recognized or handled
- Invalid non-CA certificate
- This error occurs when a non-CA certificate is used in a context where only CA certificates are valid
- Proxy path length exceeded
- This error signifies that the path length for a proxy certificate has exceeded its allowed maximum length
- Key usage does not include digital signature
- This error indicates that the key usage of a certificate does not include digital signature, which is required for certain operations.
- Proxy certificates not allowed
- This error occurs when proxy certificates are not allowed in the current operation or context.
- Invalid extension
- This error indicates that a certificate contains an invalid extension, which could affect its processing or acceptance.
- Invalid policy extension
- This error occurs when a certificate contains a policy extension that is invalid or improperly formatted.
- No explicit policy
- This error indicates that no explicit policy is found in the certificate chain, which may be required for certain operations or validations.
- Different CRL scope
- This error signifies that the scope of the Certificate Revocation List (CRL) does not match with the certificate being checked.
- Unsupported extension feature
- This error occurs when a certificate extension feature is recognized but not supported or is unimplemented in the current context.
- Unnested resource
- This error indicates that a resource in the certificate is not properly nested or structured as per the required specifications.
- Permitted violation
- This error signifies a violation of permitted constraints in the certificate's configuration or structure.
- Excluded violation
- This error occurs when the certificate contains elements or configurations that are explicitly excluded in its constraints.
- Subtree min/max
- This error indicates an issue with the minimum or maximum bounds in a certificate's subtree, often related to name constraints.
- Application verification failure
- An application-specific error
- This will never be returned unless explicitly set by an application
- Unsupported constraint type
- This error signifies that the certificate contains a constraint type that is recognized but not supported in the current context.
- Unsupported constraint syntax
- This error occurs when the syntax of a constraint in the certificate is recognized but not supported or is incorrectly formatted.
- Unsupported name syntax
- This error indicates that the name syntax in the certificate is not supported or is incorrectly formatted.
- CRL path validation error
- This error occurs during the validation of the Certificate Revocation List (CRL) path, indicating a failure in the validation process.
- Path loop
- This error signifies that a loop has been detected in the certificate path, which is not permissible for valid certificate chains.
- Suite B invalid version
- This error occurs when a certificate uses a Suite B security level but has an invalid version.
- Suite B invalid algorithm
- This error indicates that the algorithm used in a Suite B certificate is not valid.
- Suite B invalid curve
- This error occurs when a Suite B certificate uses an invalid elliptic curve.
- Suite B invalid signature algorithm
- This error signifies that the signature algorithm used in a Suite B certificate is not valid.
- Suite B LOS not allowed
- This error indicates that the Level of Security (LOS) specified in a Suite B certificate is not allowed.
- Suite B cannot sign P-384 with P-256
- This error occurs when a Suite B certificate attempts to sign using P-384 curve with a key from the P-256 curve, which is not permissible.
- Hostname mismatch
- This error signifies a mismatch between the hostname and the name specified in the certificate.
- Email mismatch
- This error occurs when there is a mismatch between the email address and the one specified in the certificate.
- IP address mismatch
- This error indicates a mismatch between the IP address and the one specified in the certificate.
- DANE no match
- This error occurs when DANE TLSA records do not match the presented certificate.
- EE key too small
- This error is triggered when the end entity's public key is too small.
- CA key too small
- This error arises when the certificate authority's public key is too small.
- CA MD too weak
- This error indicates that the message digest algorithm used by the CA is too weak.
- Invalid call
- This error denotes an invalid call was made in the certificate verification process.
- Store lookup
- This error occurs during a lookup operation in the certificate store.
- No valid SCTs
- This error is triggered when there are no valid Signed Certificate Timestamps (SCTs).
- Proxy subject name violation
- This error indicates a violation in the proxy certificate's subject name.
- OCSP verify needed
- This error means that OCSP verification is required for the certificate.
- OCSP verify failed
- This error occurs when the OCSP (Online Certificate Status Protocol) verification process fails.
- OCSP cert unknown
- This error signifies that the certificate status is unknown in the OCSP response.
- Signature algorithm mismatch
- This error indicates a mismatch in the signature algorithms between the certificate and the signature.
- No issuer public key
- This error is reported when the issuer's public key is not found.
- Unsupported signature algorithm
- This error occurs when the signature algorithm used is not supported.
- EC key explicit parameters
- This error arises when there are explicit parameters in the EC key that are not supported.