br_error_groups.md

Grouped pkilint checks with severity 'Error'

Key Usage Issues

• cabf.smime.extended_key_usage_extension_missing
• cabf.smime.unknown_certificate_key_usage_type
• cabf.smime.key_usage_extension_missing
• cabf.smime.prohibited_eku_present
• cabf.smime.prohibited_ku_present
• cabf.smime.emailprotection_eku_missing
• pkix.ca_certificate_no_ku_extension
• pkix.ca_certificate_keycertsign_keyusage_not_set
• pkix.ee_certificate_keycertsign_keyusage_set

Insecure Parameters

• cabf.smime.prohibited_spki_algorithm_encoding
• cabf.smime.is_ca_certificate
• cabf.rsa_modulus_invalid_length
• cabf.smime.unsupported_public_key_type
• pkix.certificate_signature_algorithm_mismatch
• cabf.smime.certificate_validity_period_exceeds_825_days
• cabf.smime.certificate_validity_period_exceeds_1185_days
• cabf.rsa_exponent_prohibited_value
• cabf.smime.prohibited_signature_algorithm_encoding

Missing Mandatory Info

• cabf.smime.san_does_not_contain_email_address
• cabf.certificate_extensions_missing
• pkix.subject_email_address_not_in_san
• cabf.aia_ocsp_has_no_http_uri
• cabf.smime.certificate_policies_extension_missing
• pkix.certificate_skid_ca_missing
• pkix.authority_key_identifier_keyid_missing
• pkix.authority_key_identifier_extension_absent
• cabf.smime.missing_required_attribute
• cabf.smime.no_required_reserved_policy_oid
• cabf.smime.san_extension_missing
• cabf.smime.required_attribute_missing_for_dependent_attribute
• cabf.aia_ca_issuers_has_no_http_uri
• cabf.no_http_crldp_uri

Faulty Value

• pkix.invalid_domain_name_syntax
• pkix.duplicate_extension
• cabf.invalid_organization_identifier_country
• pkix.invalid_email_address_syntax
• pkix.rdn_contains_duplicate_attribute_types
• pkix.certificate_version_is_not_v3
• pkix.invalid_uri_syntax
• msft.invalid_user_principal_name_syntax
• cabf.invalid_subject_organization_identifier_encoding
• pkix.certificate_serial_number_out_of_range
• pkix.duplicate_certificate_policy_oids
• pkix.name_domain_components_invalid_domain_name
• cabf.smime.multiple_reserved_policy_oids
• cabf.cps_uri_is_not_http
• pkix.rfc5280_certificate_policies_invalid_explicit_text_encoding
• pkix.utctime_incorrect_syntax
• cabf.invalid_subject_organization_identifier_format
• pkix.invalid_time_syntax
• pkix.basic_constraints_has_pathlen_for_non_ca
• iso.lei.invalid_lei_format
• cabf.smime.org_identifier_and_country_name_attribute_inconsistent
• cabf.invalid_organization_identifier_registration_scheme
• pkix.wrong_time_useful_type
• itu.bitstring_not_der_encoded
• pkix.certificate_negative_validity_period

Oversharing

• cabf.insignificant_attribute_value_present
• pkix.issuer_unique_id_present
• cabf.authority_key_identifier_has_issuer_cert

Prohibited Value

• cabf.smime.mixed_name_and_pseudonym_attributes
• cabf.smime.prohibited_othername_type_present
• cabf.smime.prohibited_generalname_type_present
• cabf.smime.email_address_in_attribute_not_in_san
• cabf.smime.prohibited_organization_identifier_reference_present_for_scheme
• pkix.prohibited_qualified_statement_present
• cabf.internal_ip_address
• cabf.smime.usernotice_has_noticeref
• cabf.smime.prohibited_attribute
• cabf.smime.anypolicy_present
• cabf.smime.crldp_fullname_prohibited_generalname_type
• cabf.smime.crldp_fullname_prohibited_uri_scheme
• cabf.smime.subject_directory_attributes_extension_prohibited
• cabf.internal_domain_name

Unknown Value

• cabf.invalid_country_code
• cabf.smime.common_name_value_unknown_source
• itu.invalid_printablestring_character

Wrong Criticality

• pkix.authority_key_identifier_critical
• pkix.basic_constraints_extension_not_critical
• pkix.certificate_name_constraints_extension_not_critical
• cabf.smime.qc_statements_extension_critical
• pkix.certificate_skid_extension_critical
• cabf.critical_crldp_extension
• pkix.authority_information_access_extension_critical