Enum McpClientCertificateRejection

Namespace

MailFathom.Infrastructure.Security.ClientCertificates

Assembly

MailFathom.Infrastructure.dll

Why a client certificate was not accepted by a trust profile.

public enum McpClientCertificateRejection

Fields

CertificateExpired = 4

The certificate is outside its validity period.

CertificateMissing = 0

The connection carried no client certificate while a profile requires one.

ChainNotTrusted = 5

The certificate does not chain to any of the profile's trust anchors.

ClientAuthenticationUsageMissing = 1

The certificate carries no extended key usage naming client authentication, so it is not a certificate for authenticating a client.

SubjectAlternativeNameMismatch = 2

The certificate names none of the subject alternative names the profile expects.

TrustAnchorUnavailable = 3

None of the profile's trust anchors could be loaded, so no chain could be built at all.

This describes the deployment rather than the certificate, and it refuses the request for that reason: an anchor that has become unreadable must never widen what the profile accepts.

Remarks

Every value produces the same response, so this vocabulary exists for the server log and never for the caller. It is safe to record in full: a certificate a client presented is public material, and the values here describe the certificate rather than the configuration it was judged against.