VERIFY_ERROR_CODES

Discriminant for every failure a verify operation can produce.

• no_trusted_root — chain could not be anchored to any root or TrustAnchor.
• issuer_not_found — an intermediate's issuer was not in the candidate set.
• signature_invalid — a certificate's signature failed cryptographic verification.
• certificate_expired — a certificate's notBefore/notAfter window excludes the validation time.
• ca_required — an issuer lacks basicConstraints.ca = true.
• key_cert_sign_required — an issuer has keyUsage but omits keyCertSign.
• path_length_exceeded — the number of CA certificates below an issuer exceeds its pathLength.
• authority_key_identifier_mismatch — a certificate's AKI does not match the issuer's SKI.
• extended_key_usage_invalid — the leaf certificate lacks the required EKU for the requested purpose.
• subject_alt_name_mismatch — no SAN entry matches the requested service identity.
• common_name_fallback_suppressed — CN fallback was attempted but suppressed (SAN present or disabled).
• self_signed_leaf_not_allowed — the leaf is self-signed and allowSelfSignedLeaf was not set.
• unrecognized_critical_extension — a certificate contains a critical extension the verifier cannot process.
• intermediate_eku_constraint — an intermediate CA's EKU set does not include the required purpose.
• explicit_policy_required — requireExplicitPolicy was set but no acceptable policy was found.
• initial_policy_set_not_satisfied — the chain's policies do not intersect initialPolicySet.
• unsupported_initial_name_constraints — caller-supplied initial name constraints use unsupported or malformed forms.
• unsupported_name_constraints — a certificate's nameConstraints use an unsupported form.
• name_constraints_violated — a subject name violates a permitted/excluded subtree.
• unsupported_signature_algorithm_parameters — the signature algorithm uses unrecognized parameters.
• certificate_revoked — revocation evidence confirms a chain certificate is revoked.
• revocation_indeterminate — revocation status could not be determined under a hard-fail policy.

const VERIFY_ERROR_CODES: no_trusted_root | issuer_not_found | signature_invalid | certificate_expired | ca_required | key_cert_sign_required | path_length_exceeded | authority_key_identifier_mismatch | extended_key_usage_invalid | subject_alt_name_mismatch | common_name_fallback_suppressed | self_signed_leaf_not_allowed | unrecognized_critical_extension | intermediate_eku_constraint | explicit_policy_required | initial_policy_set_not_satisfied | unsupported_initial_name_constraints | unsupported_name_constraints | name_constraints_violated | unsupported_signature_algorithm_parameters | certificate_revoked | revocation_indeterminate[]