Enum CertificateMaterialFailure

Namespace

MailFathom.Infrastructure.Certificates

Assembly

MailFathom.Infrastructure.dll

Identifies why configured certificate material produced no usable certificate.

public enum CertificateMaterialFailure

Fields

BundleCarriesNoCertificate = 5

The bundle parsed but carries no certificate.

BundlePasswordIncorrect = 8

The bundle did not open with the password the nested block supplied.

The platform reports a wrong password and corrupt bundle contents identically; the configured password is named as the likelier cause because it is the part an operator controls.

BundlePasswordMissing = 7

The bundle is protected and no nested password block was configured for it.

An unprotected bundle is a legitimate file, so this is reported only when opening the bundle without a password failed.

CertificateExpired = 14

The certificate's validity period has ended.

CertificateNotYetValid = 13

The certificate's validity period has not started yet.

ChainCarriesNonAuthorityCertificate = 20

A certificate supplied after the leaf is not a certificate authority, so it can issue nothing.

A second end-entity certificate pasted into a chain file is the usual cause; it is presented to every client and issues none of the certificates before it.

ChainCarriesSeveralLeaves = 17

The supplied chain material carries more than one certificate that could be the leaf.

A chain states one identity followed by the authorities that issued it; a second key-bearing or repeated leaf makes which identity is presented depend on parse order rather than on what an operator provisioned.

ChainCarriesUnrelatedCertificate = 22

A certificate supplied after the leaf issues neither the leaf nor another supplied certificate.

It therefore takes no part in the path a client builds, and its presence means the chain that was provisioned is not the chain the leaf belongs to.

ChainCertificateNotCurrentlyValid = 21

A certificate supplied after the leaf is outside its own validity period.

The leaf's period is reported separately, because an expired intermediate is renewed from the authority that issued it while an expired leaf is reissued for the domain.

DigitalSignatureNotPermitted = 19

The certificate's key usage excludes digitalSignature, which every negotiable handshake needs it to permit.

TLS 1.3 authenticates a server by having it sign the transcript, and the key exchanges TLS 1.2 still negotiates do the same, so a certificate limited to keyEncipherment completes no handshake this endpoint offers.

DomainNotCoveredBySubjectAlternativeName = 15

No subject alternative name of the certificate covers the configured domain.

The common name is deliberately not consulted: every current client ignores it, so honoring it here would accept material no client will.

EncodingNotRecognized = 2

The material matches none of the supported certificate encodings.

EncodingNotSupportedForRole = 18

The material parsed, but its encoding cannot serve the role the setting configured it for.

A PEM chain placed in the bundle setting and a PKCS#12 bundle placed in the chain setting are both this failure; each is a legitimate file in the other setting.

InlineEncodingNotSupported = 3

Binary material was supplied inline, where only PEM has a faithful representation.

MaterialKindAmbiguous = 9

A PKCS#12 bundle and separate PEM material were both configured, so which one supplies the identity is undecidable.

MaterialMissing = 0

No material is configured at all.

MaterialNotReadable = 4

The material has a supported encoding but does not parse.

PrivateKeyDoesNotMatchCertificate = 12

The private key parsed but belongs to a different certificate than the leaf it was configured beside.

PrivateKeyMissing = 10

The material carries no private key, so it identifies a server it cannot prove it is.

PrivateKeyNotReadable = 11

The private-key material does not parse, or the password configured for it did not open it.

The two are one identity because the platform reports them identically and neither may be narrowed by disclosing which part of the material was rejected.

SecretNotResolvable = 1

The configured reference, or the reference to the bundle password, produced no material.

The resolution failure itself is reported separately by the startup check that walks every secret-bearing setting, which is where an operator reads the exact cause.

ServerAuthenticationNotPermitted = 16

The certificate's extended key usage excludes server authentication.

TrustAnchorCarriesPrivateKey = 6

The certificate carries a private key, which a trust anchor must not.

Remarks

The identity is the whole failure vocabulary a diagnostic may carry. A trust anchor is public material, so its subject and thumbprint may be logged once it loads, but nothing here may carry the reference target, the bundle password, or any part of the material that failed to load.