Enum Error 

#[non_exhaustive]
pub enum Error {
    Codec(Error),
    MissingField(u8),
    DuplicateField(u8),
    WrongFieldType(u8),
    FieldValueOutOfRange {
        tag: u8,
    },
    InvalidSerialLength {
        len: usize,
    },
    UnsupportedSignatureAlgorithm(u8),
    UnsupportedPublicKeyAlgorithm(u8),
    UnsupportedEcCurve(u8),
    WrongPublicKeyLength(usize),
    BadPublicKeyPrefix,
    MissingBuilderField(&'static str),
    WrongSignatureLength(usize),
    InvalidDnAttribute(u8),
    InvalidDnAttributeType(u8),
    WrongKeyIdentifierLength(usize),
    DnAttributeHasNoX509Oid(u8),
    DnAttributeNotTlvEncodable(&'static str),
    InvalidDnAttributeForX509 {
        asn1_type: &'static str,
        reason: &'static str,
    },
    SignatureVerificationFailed,
    TestX509SigningFailed(&'static str),
    NotYetValid {
        cert_index: u8,
        not_before: MatterTime,
        at: MatterTime,
    },
    Expired {
        cert_index: u8,
        not_after: MatterTime,
        at: MatterTime,
    },
    UntrustedRoot,
    IssuerSubjectMismatch {
        cert_index: u8,
    },
    NotACa {
        cert_index: u8,
    },
    PathLengthExceeded {
        cert_index: u8,
    },
    MissingKeyCertSign {
        cert_index: u8,
    },
    LeafIsCa,
}

All errors matter-cert can produce.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Codec(Error)

TLV decoding or encoding failed inside matter-codec.

MissingField(u8)

A required certificate field was missing.

DuplicateField(u8)

A certificate field appeared more than once.

WrongFieldType(u8)

A certificate field had an unexpected element type.

FieldValueOutOfRange

A certificate field’s value was outside the spec-defined range.

Fields

tag: u8

Context tag of the offending field.

InvalidSerialLength

The certificate serial number had a length outside the spec-allowed range of 1..=20 bytes.

The Matter operational-certificate profile (§6.5) inherits the X.509 CertificateSerialNumber constraint (RFC 5280 §4.1.2.2): a serial is at most 20 octets, and a zero-length serial is not a valid INTEGER. We reject both bounds at parse time so a malformed serial cannot propagate into the X.509 TBS encoder or signature verification.

Fields

len: usize

The offending serial-number length, in bytes.

UnsupportedSignatureAlgorithm(u8)

Signature algorithm identifier was not ecdsa-with-sha256 (1).

UnsupportedPublicKeyAlgorithm(u8)

Public-key algorithm identifier was not ec-public-key (1).

UnsupportedEcCurve(u8)

EC curve identifier was not prime256v1 (1).

WrongPublicKeyLength(usize)

Public-key bytes had wrong length.

BadPublicKeyPrefix

Public-key bytes did not start with the uncompressed-point marker (0x04).

MissingBuilderField(&'static str)

A required field on MatterCertificate::builder() was not set before build_unsigned() was called.

WrongSignatureLength(usize)

Signature bytes had wrong length.

InvalidDnAttribute(u8)

A distinguished-name attribute used a context tag not defined by the spec.

InvalidDnAttributeType(u8)

A distinguished-name attribute’s value had the wrong TLV element type.

WrongKeyIdentifierLength(usize)

A key identifier had the wrong length (must be 20 bytes).

DnAttributeHasNoX509Oid(u8)

A Matter DN attribute had no defined X.509 OID mapping.

Occurs when a crate::DnAttribute::Other is encountered during X.509 conversion. We cannot invent an X.509 OID, and matter.js wouldn’t have signed against one we made up.

DnAttributeNotTlvEncodable(&'static str)

A DN attribute belongs only to X.509 attestation certificates and has no Matter operational-TLV cert encoding.

Produced if crate::DnAttribute::VendorId or crate::DnAttribute::ProductId is routed through the Matter TLV writer. VID/PID identifiers live in DAC/PAI/PAA X.509 attestation cert DNs (Matter §6.5.6.1), not in operational NOC/ICAC/RCAC TLV certs, so there is no spec-defined TLV context tag for them.

InvalidDnAttributeForX509

A DN attribute’s value cannot be encoded in its X.509 ASN.1 string type.

E.g., a CountryName containing non-printable bytes cannot be encoded as PrintableString.

Fields

asn1_type: &'static str

The ASN.1 string type that the encoding attempt targeted.

reason: &'static str

Why the value did not fit.

SignatureVerificationFailed

Signature verification failed.

Reserved for M2.2; not produced by phase 1.

TestX509SigningFailed(&'static str)

Test-support X.509 cert signing failed.

Produced only by test_support::build_x509_der (behind the test-support feature) when the supplied issuer PKCS#8 key is malformed or ring rejects the signing request. Never produced by production code paths.

NotYetValid

A certificate’s not_before is in the future.

Fields

cert_index: u8

Index of the offending cert in the chain (0 = leaf).

not_before: MatterTime

The certificate’s not_before timestamp.

at: MatterTime

The time at which validation was attempted.

Expired

A certificate’s not_after is in the past.

Fields

cert_index: u8

Index of the offending cert in the chain (0 = leaf).

not_after: MatterTime

The certificate’s not_after timestamp.

at: MatterTime

The time at which validation was attempted.

UntrustedRoot

A certificate chain did not terminate at a trusted root.

IssuerSubjectMismatch

A cert’s issuer did not match the next cert’s subject.

Fields

cert_index: u8

Index of the cert whose issuer did not match (0 = leaf).

NotACa

A non-leaf certificate did not have basic_constraints.is_ca = true.

Fields

cert_index: u8

Index of the non-CA intermediate (always > 0).

PathLengthExceeded

Chain length exceeded a cert’s path_len_constraint.

Fields

cert_index: u8

Index of the cert whose path-length constraint was violated.

MissingKeyCertSign

A non-leaf (CA) certificate lacked the keyCertSign KeyUsage bit.

RFC 5280 §4.2.1.3 and Matter §6.5.5 require any certificate that signs other certificates to carry the keyCertSign KeyUsage bit (and a KeyUsage extension at all). A cert asserting is_ca = true but lacking KeyUsage::KEY_CERT_SIGN (or with no KeyUsage extension) is not a valid signing CA and is rejected here.

Fields

cert_index: u8

Index of the offending CA cert in the chain (always > 0).

LeafIsCa

The end-entity leaf certificate asserted basic_constraints.is_ca = true.

RFC 5280 forbids an end-entity (leaf) certificate from asserting the CA bit. A leaf at chain index 0 with an explicit is_ca = true is a profile violation and is rejected. An absent basic_constraints extension on the leaf is permitted (it is not a violation).

Trait Implementations

impl Debug for Error

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for Error

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for Error

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<Error> for Error

fn from(source: Error) -> Self

Converts to this type from the input type.