Enum ChainError 

pub enum ChainError {
    EmptyChain,
    ChainTooDeep {
        depth: usize,
        max: usize,
    },
    NameMismatch,
    DomainMismatch,
    Link(CredentialError),
    DelegationOutOfNamespace {
        subject: String,
        delegated_namespace: String,
    },
}

Reasons a certificate chain fails to verify. tag() yields a stable machine string for structured logging + JSON error envelopes, mirroring CredentialError::tag.

Variants

EmptyChain

The chain carried no leaf at all (structurally impossible to present a CertChain, retained for completeness of the error surface).

ChainTooDeep

The chain is deeper than the receiver’s configured maximum.

Fields

depth: usize

The presented depth (intermediates + leaf).

max: usize

The configured cap.

NameMismatch

A cert’s issuer_id does not equal its parent’s subject_agent_id: the key chain links but the name chain does not, so the parent never vouched for this issuer name.

DomainMismatch

Two adjacent links disagree on trust_domain — a credential from one tenant must not ride a chain anchored in another.

Link(CredentialError)

A credential-layer failure at some link (bad signature, expired, not-yet-valid, unknown/anchor issuer, bad subject key, unsupported version).

DelegationOutOfNamespace

#1554 — an intermediate signed a child whose subject_agent_id falls OUTSIDE the namespace that intermediate is delegated to (e.g. region/nyc/ca minting region/sfo/node-1). The key + name chain link, but the parent has no authority to vouch for this subject. Enforcing this inside verify (not as caller-optional policy) closes the delegation-confinement bypass.

Fields

subject: String

The child subject the parent had no authority to sign.

delegated_namespace: String

The namespace the issuing intermediate is confined to.

Implementations

impl ChainError

pub fn tag(&self) -> &'static str

Stable machine-readable tag for logs + JSON error envelopes.

Trait Implementations

impl Clone for ChainError

fn clone(&self) -> ChainError

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ChainError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for ChainError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ChainError

impl Error for ChainError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<CredentialError> for ChainError

fn from(e: CredentialError) -> Self

Converts to this type from the input type.

impl PartialEq for ChainError

fn eq(&self, other: &ChainError) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for ChainError