VerifyFailureDetails

VerifyFailureDetails

Diagnostic context attached to every VerifyChainFailure. All fields are optional; presence depends on the error code.

interface VerifyFailureDetails {
	readonly subjectCommonName?: string;
	readonly issuerCommonName?: string;
	readonly expected?: string;
	readonly actual?: string;
	readonly chainCommonNames?: readonly string[];
	readonly presentedIdentifierTypes?: readonly ("dns" | "uri" | "srv")[];
	readonly commonNameFallbackReason?: "disabled" | "suppressed_by_presented_identifier" | "common_name_missing" | "common_name_mismatch";
	readonly userNoticeField?: "explicitText" | "noticeRefOrganization";
	readonly source?: VerifyFailureSource;
}

Properties

• readonly subjectCommonName?: string — CN of the certificate that triggered the failure.
• readonly issuerCommonName?: string — CN of the issuer of the offending certificate.
• readonly expected?: string — The value the verifier expected (e.g. a validity window bound or SKI).
• readonly actual?: string — The value actually found.
• readonly chainCommonNames?: readonly string``[] — CNs of every certificate in the chain, leaf-first. Present on no_trusted_root.
• readonly presentedIdentifierTypes?: readonly ("dns" | "uri" | "srv")[] — SAN identifier types the leaf actually presents. Set on identity-match failures.
• readonly commonNameFallbackReason?: "disabled" | "suppressed_by_presented_identifier" | "common_name_missing" | "common_name_mismatch" — Why the CN-fallback path was not taken. Set on common_name_fallback_suppressed.
• readonly userNoticeField?: "explicitText" | "noticeRefOrganization" — The user notice DisplayText that exceeds 200 characters. Set on display_text_oversized.
• readonly source?: VerifyFailureSource — The intermediates or roots entry that failed to load, which has no chain index.