Uses of Annotation Interface
de.mtg.jzlint.Lint

Packages that use Lint

Package	Description
de.mtg.jzlint.lints.apple
de.mtg.jzlint.lints.cabf_br
de.mtg.jzlint.lints.cabf_ev
de.mtg.jzlint.lints.cabf_smime_br
de.mtg.jzlint.lints.community
de.mtg.jzlint.lints.etsi
de.mtg.jzlint.lints.mozilla
de.mtg.jzlint.lints.rfc

Uses of Lint in de.mtg.jzlint.lints.apple

Classes in de.mtg.jzlint.lints.apple with annotations of type Lint

Modifier and Type	Class	Description
class	CtSctPolicyCountUnsatisfied
class	TlsServerCertValidTimeLongerThan397Days
class	TlsServerCertValidTimeLongerThan398Days

Uses of Lint in de.mtg.jzlint.lints.cabf_br

Classes in de.mtg.jzlint.lints.cabf_br with annotations of type Lint

Modifier and Type	Class	Description
class	AlgorithmIdentifierImproperEncoding	This lint refers to CAB Baseline Requirements (Version 1.7.4) chapter 7.1.3.1, which defines the required encodings of AlgorithmObjectIdentifiers inside a SubjectPublicKeyInfo field.
class	BrProhibitDsaUsage
class	CabCrlHasValidReasonCode
class	CabCrlReasonCodeNotCritical
class	CabDvConflictsWithLocality
class	CabDvConflictsWithOrg	BRs: 7.1.6.4 Certificate Policy Identifier: 2.23.140.1.2.1 If the Certificate complies with these requirements and lacks Subject identity information that has been verified in accordance with Section 3.2.2.1 or Section 3.2.3.
class	CabDvConflictsWithPostal	BRs: 7.1.6.4 Certificate Policy Identifier: 2.23.140.1.2.1 If the Certificate complies with these requirements and lacks Subject identity information that has been verified in accordance with Section 3.2.2.1 or Section 3.2.3.
class	CabDvConflictsWithProvince	BRs: 7.1.6.4 Certificate Policy Identifier: 2.23.140.1.2.1 If the Certificate complies with these requirements and lacks Subject identity information that has been verified in accordance with Section 3.2.2.1 or Section 3.2.3.
class	CabDvConflictsWithStreet	BRs: 7.1.6.4 Certificate Policy Identifier: 2.23.140.1.2.1 If the Certificate complies with these requirements and lacks Subject identity information that has been verified in accordance with Section 3.2.2.1 or Section 3.2.3.
class	CabDvSubjectInvalidValues	7.1.2.7.2 Domain Validated The following table details the acceptable AttributeTypes that may appear within the type field of an AttributeTypeAndValue, as well as the contents permitted within the value field.
class	CabIvRequiresPersonalName	BRs: 7.1.6.4 Certificate Policy Identifier: 2.23.140.1.2.3 If the Certificate complies with these Requirements and includes Subject Identity Information that is verified in accordance with Section 3.2.3.
class	CabOvRequiresOrg	BRs: 7.1.6.4 Certificate Policy Identifier: 2.23.140.1.2.2 If the Certificate complies with these Requirements and includes Subject Identity Information that is verified in accordance with Section 3.2.2.1.
class	CaCommonNameMissing
class	CaCountryNameInvalid	BRs: 7.1.2.1e The Certificate Subject MUST contain the following: - countryName (OID 2.5.4.6).
class	CaCountryNameMissing	BRs: 7.1.2.1e The Certificate Subject MUST contain the following: - countryName (OID 2.5.4.6).
class	CaCrlSignNotSet	BRs: 7.1.2.1b This extension MUST be present and MUST be marked critical.
class	CaDigitalSignatureNotSet	BRs: 7.1.2.1b: Root CA Certificate keyUsage This extension MUST be present and MUST be marked critical.
class	CaIsCa
class	CaKeyCertSignNotSet	BRs: 7.1.2.1b This extension MUST be present and MUST be marked critical.
class	CaKeyUsageMissing	RFC 5280: 4.2.1.3 Conforming CAs MUST include this extension in certificates that contain public keys that are used to validate digital signatures on other public key certificates or CRLs.
class	CaKeyUsageNotCritical	BRs: 7.1.2.1b This extension MUST be present and MUST be marked critical.
class	CaOrganizationNameMissing	BRs: 7.1.2.1e The Certificate Subject MUST contain the following: organizationName (OID 2.5.4.10): This field MUST be present and the contents MUST contain either the Subject CA’s name or DBA as verified under Section 3.2.2.2.
class	CertPolicyIvRequiresCountry	BRs: 7.1.6.4 Certificate Policy Identifier: 2.23.140.1.2.3 If the Certificate complies with these Requirements and includes Subject Identity Information that is verified in accordance with Section 3.2.3.
class	CertPolicyIvRequiresProvinceOrLocality	BRs: 7.1.6.4 Certificate Policy Identifier: 2.23.140.1.2.3 If the Certificate complies with these Requirements and includes Subject Identity Information that is verified in accordance with Section 3.2.3.
class	CertPolicyOvRequiresCountry	BRs: 7.1.6.4 Certificate Policy Identifier: 2.23.140.1.2.2 If the Certificate complies with these Requirements and includes Subject Identity Information that is verified in accordance with Section 3.2.2.1.
class	CertPolicyOvRequiresProvinceOrLocality	BRs: 7.1.6.4 Certificate Policy Identifier: 2.23.140.1.2.2 If the Certificate complies with these Requirements and includes Subject Identity Information that is verified in accordance with Section 3.2.2.1.
class	CrlissuerMustNotBePresentInCdp
class	DnsnameBadCharacterInLabel
class	DnsnameContainsProhibitedReservedLabel
class	DnsnameEmptyLabel
class	DnsnameHyphenInSld
class	DnsnameLabelTooLong
class	DnsnameLeftLabelWildcardCorrect
class	DnsnameNotValidTld
class	DnsnameUnderscoreInSld
class	DnsnameUnderscoreInTrd
class	DnsnameWildcardOnlyInLeftLabel
class	DsaCorrectOrderInSubgroup
class	DsaImproperModulusOrDivisorSize
class	DsaParamsMissing
class	DsaShorterThan2048Bits
class	DsaUniqueCorrectRepresentation
class	EcImproperCurves	BRs: 6.1.5 Certificates MUST meet the following requirements for algorithm type and key size.
class	EkuCritical
class	ExtraSubjectCommonNames
class	ExtSanCriticalWithSubjectDn	Further, if the only subject identity included in the certificate is an alternative name form (e.g., an electronic mail address), then the subject distinguished name MUST be empty (an empty sequence), and the subjectAltName extension MUST be present.
class	ExtSanDirectoryNamePresent	7.1.4.2.1.
class	ExtSanEdiPartyNamePresent	7.1.4.2.1.
class	ExtSanMissing	BRs: 7.1.4.2.1 Subject Alternative Name Extension Certificate Field: extensions:subjectAltName Required/Optional: Required
class	ExtSanOtherNamePresent	7.1.4.2.1.
class	ExtSanRegisteredIdPresent	7.1.4.2.1.
class	ExtSanRfc822NamePresent	7.1.4.2.1.
class	ExtSanUniformResourceIdentifierPresent	7.1.4.2.1.
class	ExtSubjectKeyIdentifierNotRecommendedSubscriber	RFC5280 suggested the addition of SKI extension, but CABF BR SC62 marked the extension as NOT RECOMMENDED for subscriber certificates Warning: Users of zlint will trigger either `w_ext_subject_key_identifier_not_recommended_subscriber` (this lint) or `w_ext_subject_key_identifier_missing_sub_cert` the one enforcing RFC5280's behavior.
class	InvalidCertificateVersion	Certificates MUST be of type X.509 v3.
class	InvalidSubjectRdnOrder
class	NoUnderscoresBefore162
class	OcspIdPkixOcspNocheckExtNotIncludedServerAuth
class	OldRootCaRsaModLessThan2048Bits
class	OldSubCaRsaModLessThan1024Bits
class	OldSubCertRsaModLessThan1024Bits
class	OrganizationalUnitNameProhibited
class	PolicyQualifiersOtherThanCpsNotPermitted
class	PublicKeyTypeNotAllowed
class	RootCaBasicConstraintsPathLenConstraintFieldPresent	7.1.2.1.
class	RootCaContainsCertPolicy	BRs: 7.1.2.1c certificatePolicies This extension SHOULD NOT be present.
class	RootCaExtendedKeyUsagePresent	BRs: 7.1.2.1d extendedKeyUsage This extension MUST NOT be present.
class	RootCaKeyUsageMustBeCritical
class	RootCaKeyUsagePresent
class	RsaModFactorsSmallerThan752	6.1.6.
class	RsaModLessThan2048Bits
class	RsaModNotOdd	"BRs: 6.1.6" RSA: The CA SHALL confirm that the value of the public exponent is an odd number equal to 3 or more.
class	RsaPublicExponentNotInRange	"BRs: 6.1.6" RSA: The CA SHALL confirm that the value of the public exponent is an odd number equal to 3 or more.
class	RsaPublicExponentNotOdd	"BRs: 6.1.6" RSA: The CA SHALL confirm that the value of the public exponent is an odd number equal to 3 or more.
class	RsaPublicExponentTooSmall	"BRs: 6.1.6" RSA: The CA SHALL confirm that the value of the public exponent is an odd number equal to 3 or more.
class	SignatureAlgorithmNotSupported
class	SubCaAiaDoesNotContainIssuingCaUrl	BRs: 7.1.2.2c This extension SHOULD be present.
class	SubCaAiaMarkedCritical
class	SubCaAiaMissing	CAB 7.1.2.2c With the exception of stapling, which is noted below, this extension MUST be present.
class	SubCaAiaMissingWarning	CAB BR 1.7.1 Section 7.1.2.2c - authorityInformationAccess This extension SHOULD be present.
class	SubCaCertificatePoliciesMarkedCritical	BRs: 7.1.2.2a certificatePolicies This extension MUST be present and SHOULD NOT be marked critical.
class	SubCaCertificatePoliciesMissing	BRs: 7.1.2.2a certificatePolicies This extension MUST be present and SHOULD NOT be marked critical.
class	SubCaCrlDistributionPointsDoesNotContainUrl	BRs: 7.1.2.2b cRLDistributionPoints This extension MUST be present and MUST NOT be marked critical.
class	SubCaCrlDistributionPointsMarkedCritical	BRs: 7.1.2.2b cRLDistributionPoints This extension MUST be present and MUST NOT be marked critical.
class	SubCaCrlDistributionPointsMissing	BRs: 7.1.2.2b cRLDistributionPoints This extension MUST be present and MUST NOT be marked critical.
class	SubCaEkuCritical	BRs: 7.1.2.2g extkeyUsage (optional) For Subordinate CA Certificates to be Technically constrained in line with section 7.1.5, then either the value id-kp-serverAuth [RFC5280] or id-kp-clientAuth [RFC5280] or both values MUST be present.
class	SubCaEkuMissing
class	SubCaEkuNotTechnicallyConstrained
class	SubCaNameConstraintsNotCritical	CA Brower Forum Baseline Requirements, Section 7.1.2.2: f. nameConstraints (optional) If present, this extension SHOULD be marked critical*.
class	SubCertAiaContainsInternalNames	BRs: 7.1.2.10.3 CA Certificate Authority Information Access This extension MAY be present.
class	SubCertAiaDoesNotContainIssuingCaUrl	BRs: 7.1.2.3 cRLDistributionPoints This extension MAY be present.
class	SubCertAiaDoesNotContainOcspUrl	BRs: 7.1.2.3 authorityInformationAccess This extension MUST be present.
class	SubCertAiaMarkedCritical
class	SubCertAiaMissing	BRs: 7.1.2.3 authorityInformationAccess With the exception of stapling, which is noted below, this extension MUST be present.
class	SubCertBasicConstraintsNotCritical	CA/Browser Forum BRs: 7.1.2.7.6 Subscriber Certificate Extensions | __Extension__ | __Presence__ | __Critical__ | __Description__ | | ---- | - | - | ----- | | `basicConstraints` | MAY | Y | See [Section 7.1.2.7.8](#71278-subscriber-certificate-basic-constraints) |
class	SubCertCertificatePoliciesMarkedCritical	BRs: 7.1.2.3 certificatePolicies This extension MUST be present and SHOULD NOT be marked critical.
class	SubCertCertificatePoliciesMissing	BRs: 7.1.2.3 certificatePolicies This extension MUST be present and SHOULD NOT be marked critical.
class	SubCertCertPolicyEmpty
class	SubCertCountryNameMustAppear
class	SubCertCrlDistributionPointsDoesNotContainUrl	BRs: 7.1.2.3 cRLDistributionPoints This extension MAY be present.
class	SubCertCrlDistributionPointsMarkedCritical	BRs: 7.1.2.3 cRLDistributionPoints This extension MAY be present.
class	SubCertEkuExtraValues	BRs: 7.1.2.3 extKeyUsage (required) Either the value id-kp-serverAuth [RFC5280] or id-kp-clientAuth [RFC5280] or both values MUST be present. id-kp-emailProtection [RFC5280] MAY be present.
class	SubCertEkuMissing	BRs: 7.1.2.3 extKeyUsage (required) Either the value id-kp-serverAuth [RFC5280] or id-kp-clientAuth [RFC5280] or both values MUST be present. id-kp-emailProtection [RFC5280] MAY be present.
class	SubCertEkuServerAuthClientAuthMissing	BRs: 7.1.2.3 extKeyUsage (required) Either the value id-kp-serverAuth [RFC5280] or id-kp-clientAuth [RFC5280] or both values MUST be present. id-kp-emailProtection [RFC5280] MAY be present.
class	SubCertGivenNameSurnameContainsCorrectPolicy
class	SubCertKeyUsageCertSignBitSet	BRs: 7.1.2.3 keyUsage (optional) If present, bit positions for keyCertSign and cRLSign MUST NOT be set.
class	SubCertKeyUsageCrlSignBitSet	BRs: 7.1.2.3 keyUsage (optional) If present, bit positions for keyCertSign and cRLSign MUST NOT be set.
class	SubCertLocalityNameMustAppear
class	SubCertLocalityNameMustNotAppear
class	SubCertNotIsCa
class	SubCertOrSubCaUsingSha1	BRs: 7.1.3 SHA-1 MAY be used with RSA keys in accordance with the criteria defined in Section 7.1.3.
class	SubCertPostalCodeMustNotAppear
class	SubCertProvinceMustAppear
class	SubCertProvinceMustNotAppear
class	SubCertSha1ExpirationTooLong	Effective 16 January 2015, CAs SHOULD NOT issue Subscriber Certificates utilizing the SHA-1 algorithm with an Expiry Date greater than 1 January 2017 because Application Software Providers are in the process of deprecating and/or removing the SHA-1 algorithm from their software, and they have communicated that CAs and Subscribers using such certificates do so at their own risk.
class	SubCertStreetAddressShouldNotExist
class	SubCertValidTimeLongerThan39Months
class	SubCertValidTimeLongerThan825Days
class	SubjectCommonNameIncluded	BRs: 7.1.4.2.2 Required/Optional: Deprecated (Discouraged, but not prohibited)
class	SubjectCommonNameIncludedW	BRs: 7.1.2.7.1 Required/Optional: NOT RECOMMENDED
class	SubjectCommonNameNotExactlyFromSan	If present, this field MUST contain exactly one entry that is one of the values contained in the Certificate's `subjectAltName` extension If the [subject:commonName] is a Fully-Qualified Domain Name or Wildcard Domain Name, then the value MUST be encoded as a character-for-character copy of the dNSName entry value from the subjectAltName extension.
class	SubjectCommonNameNotFromSan	BRs: 7.1.4.2.2 If present, this field MUST contain a single IP address or Fully-Qualified Domain Name that is one of the values contained in the Certificate’s subjectAltName extension (see Section 7.1.4.2.1).
class	SubjectContainsNoninformationalValue	BRs: 7.1.4.2.2 Other Subject Attributes With the exception of the subject:organizationalUnitName (OU) attribute, optional attributes, when present within the subject field, MUST contain information that has been verified by the CA.
class	SubjectContainsOrganizationalUnitNameAndNoOrganizationName	BRs: 7.1.4.2.2 Certificate Field: subject:organizationalUnitName (OID: 2.5.4.11) Required/Optional: Deprecated.
class	SubjectCountryNotIso	BRs: 7.1.4.2.2 Certificate Field: issuer:countryName (OID 2.5.4.6) Required/Optional: Required Contents: This field MUST contain the two-letter ISO 3166-1 country code for the country in which the issuer’s place of business is located.
class	UnderscoreNotPermissibleInDnsname
class	UnderscorePermissibleInDnsnameIfValidWhenReplaced
class	UnderscorePresentWithTooLongValidity

Uses of Lint in de.mtg.jzlint.lints.cabf_ev

Classes in de.mtg.jzlint.lints.cabf_ev with annotations of type Lint

Modifier and Type	Class	Description
class	EOnionSubjectValidityTimeTooLarge
class	EvBusinessCategoryMissing
class	EvCountryNameMissing
class	EvNotWildcard
class	EvOrganizationIdMissing
class	EvOrganizationNameMissing
class	EvSanIpAddressPresent
class	EvSerialNumberMissing
class	EvValidTimeTooLong

Uses of Lint in de.mtg.jzlint.lints.cabf_smime_br

Classes in de.mtg.jzlint.lints.cabf_smime_br with annotations of type Lint

Modifier and Type	Class	Description
class	AdobeExtensionsLegacyMultipurposeCriticality
class	AdobeExtensionsStrictPresence
class	AuthorityKeyIdentifierCorrect
class	CommonnameMailboxValidated
class	EcOtherKeyUsages
class	EcpublickeyKeyUsages
class	EdwardspublickeyKeyUsages
class	KeyUsageCriticality
class	KeyUsagePresence
class	LegalEntityIdentifier
class	MailboxAddressShallContainAnRfc822Name
class	MailboxValidatedEnforceSubjectFieldRestrictions
class	RegistrationSchemeIdMatchesSubjectCountry
class	RsaKeyUsageLegacyMultipurpose
class	RsaKeyUsageStrict
class	RsaOtherKeyUsages
class	SanShallBePresent
class	SanShouldNotBeCritical
class	SingleEmailIfPresent	7.1.4.2.1 Subject alternative name extension All Mailbox Addresses in the subject field or entries of type dirName of this extension SHALL be repeated as rfc822Name or otherName values of type id-on-SmtpUTF8Mailbox in this extension. 7.1.4.2.2 Subject distinguished name fields h.
class	SingleEmailSubjectIfPresent
class	SmimeAiaContainsInternalNames	BRs: 7.1.2.3c CA Certificate Authority Information Access The authorityInformationAccess extension MAY contain one or more accessMethod values for each of the following types: id-ad-ocsp specifies the URI of the Issuing CA's OCSP responder.
class	SmimeLegacyAiaShallHaveOneHttp	BRs: 7.1.2.3c CA Certificate Authority Information Access The authorityInformationAccess extension MAY contain one or more accessMethod values for each of the following types: id-ad-ocsp specifies the URI of the Issuing CA's OCSP responder.
class	SmimeLegacyMultipurposeEkuCheck
class	SmimeQcStatementsMustNotBeCritical
class	SmimeStrictAiaShallHaveHttpOnly	BRs: 7.1.2.3c CA Certificate Authority Information Access The authorityInformationAccess extension MAY contain one or more accessMethod values for each of the following types: id-ad-ocsp specifies the URI of the Issuing CA's OCSP responder.
class	SmimeStrictEkuCheck
class	StrictMultipurposeSmimeExtSubjectDirectoryAttr
class	SubjectCountryName
class	SubscribersCrlDistributionPointsAreHttp
class	SubscribersShallHaveCrlDistributionPoints

Uses of Lint in de.mtg.jzlint.lints.community

Classes in de.mtg.jzlint.lints.community with annotations of type Lint

Modifier and Type	Class	Description
class	IanBareWildcard
class	IanDnsNameIncludesNullChar
class	IanDnsNameStartsWithPeriod
class	IanIanaPubSuffixEmpty
class	IanWildcardNotFirst
class	IssuerDnLeadingWhitespace
class	IssuerDnTrailingWhitespace
class	MultipleIssuerRdn
class	MultipleSubjectRdn
class	RsaExpNegative
class	RsaFermatFactorization
class	RsaNoPublicKey
class	SanBareWildcard
class	SanDnsNameDuplicate
class	SanDnsNameIncludesNullChar
class	SanDnsNameStartsWithPeriod
class	SanIanaPubSuffixEmpty
class	SanWildcardNotFirst
class	SubjectDnLeadingWhitespace
class	SubjectDnTrailingWhitespace
class	ValidityTimeNotPositive

Uses of Lint in de.mtg.jzlint.lints.etsi

Classes in de.mtg.jzlint.lints.etsi with annotations of type Lint

Modifier and Type	Class	Description
class	QcstatemEtsiPresentQcsCritical
class	QcstatemEtsiTypeAsStatem
class	QcstatemMandatoryEtsiStatems
class	QcstatemQccomplianceValid
class	QcstatemQclimitvalueValid
class	QcstatemQcpdsLangCase
class	QcstatemQcpdsValid
class	QcstatemQcretentionperiodValid
class	QcstatemQcsscdValid
class	QcstatemQctypeValid
class	QcstatemQctypeWeb

Uses of Lint in de.mtg.jzlint.lints.mozilla

Classes in de.mtg.jzlint.lints.mozilla with annotations of type Lint

Modifier and Type	Class	Description
class	MpAllowedEku	Section 5.3 - Intermediate Certificates Intermediate certificates created after January 1, 2019, with the exception of cross-certificates that share a private key with a corresponding root certificate: MUST contain an EKU extension; and, MUST NOT include the anyExtendedKeyUsage KeyPurposeId; and, * MUST NOT include both the id-kp-serverAuth and id-kp-emailProtection KeyPurposeIds in the same certificate.
class	MpAuthorityKeyIdentifierCorrect	Section 5.2 - Forbidden and Required Practices CAs MUST NOT issue certificates that have: - incorrect extensions (e.g., SSL certificates that exclude SSL usage, or authority key IDs that include both the key ID and the issuer’s issuer name and serial number);
class	MpEcdsaPubKeyEncodingCorrect	https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/ When ECDSA keys are encoded in a SubjectPublicKeyInfo structure, the algorithm field MUST be one of the following, as specified by RFC 5480, Section 2.1.1: The encoded AlgorithmIdentifier for a P-256 key MUST match the following hex-encoded bytes: > 301306072a8648ce3d020106082a8648ce3d030107.
class	MpEcdsaSignatureEncodingCorrect	https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/ When a root or intermediate certificate's ECDSA key is used to produce a signature, only the following algorithms may be used, and with the following encoding requirements: If the signing key is P-256, the signature MUST use ECDSA with SHA-256.
class	MpExponentCannotBeOne	Section 5.2 - Forbidden and Required Practices CAs MUST NOT issue certificates that have: - invalid public keys (e.g., RSA certificates with public exponent equal to 1);
class	MpModulusMustBe2048BitsOrMore	Section 5.1 - Algorithms RSA keys whose modulus size in bits is divisible by 8, and is at least 2048.
class	MpModulusMustBeDivisibleBy8	Section 5.1 - Algorithms RSA keys whose modulus size in bits is divisible by 8, and is at least 2048.
class	MpRsassaPssInSpki	https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/ Section 5.1.1 RSA CAs MUST NOT use the id-RSASSA-PSS OID (1.2.840.113549.1.1.10) within a SubjectPublicKeyInfo to represent a RSA key.
class	ProhibitDsaUsage	https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/ Subsection 5.1 Algorithms Root certificates in our root program, and any certificate which chains up to them, MUST use only algorithms and key sizes from the following set: - RSA keys whose modulus size in bits is divisible by 8, and is at least 2048
class	PssParametersEncodingInSignatureAlgorithmCorrect	https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/ Section 5.1.1 RSA RSASSA-PSS with SHA-256, MGF-1 with SHA-256, and a salt length of 32 bytes.

Uses of Lint in de.mtg.jzlint.lints.rfc

Classes in de.mtg.jzlint.lints.rfc with annotations of type Lint

Modifier and Type	Class	Description
class	BasicConstraintsNotCritical	RFC 5280: 4.2.1.9 Conforming CAs MUST include this extension in all CA certificates that contain public keys used to validate digital signatures on certificates and MUST mark the extension as critical in such certificates.
class	CASubjectFieldEmpty	RFC 5280: 4.1.2.6 The subject field identifies the entity associated with the public key stored in the subject public key field.
class	CertContainsUniqueIdentifier	These fields MUST only appear if the version is 2 or 3 (Section 4.1.2.1).
class	CertExtensionsVersionNot3	4.1.2.1.
class	CertSigAlgNotMatchTbsSigAlg	RFC 5280: 4.1.1.2 [the Certificate signatureAlgorithm] field MUST contain the same algorithm identifier as the signature field in the sequence tbsCertificate
class	CertUniqueIdentifierVersionNot2Or3	RFC 5280: 4.1.2.8 These fields MUST only appear if the version is 2 or 3 (Section 4.1.2.1).
class	CrlHasValidReasonCode
class	CrlNextUpdateMandatory	RFC 5280: 5.1.2.5 Conforming CRL issuers MUST include the nextUpdate field in all CRLs.
class	DistributionPointIncomplete	The cRLDistributionPoints extension is a SEQUENCE of DistributionPoint.
class	DistributionPointMissingLdapOrUri	RFC 5280: 4.2.1.13 When present, DistributionPointName SHOULD include at least one LDAP or HTTP URI.
class	EcdsaAllowedKu	RFC 8813: 3.
class	EcdsaEeInvalidKu
class	EkuCriticalImproperly	RFC 5280: 4.2.1.12 If a CA includes extended key usages to satisfy such applications, but does not wish to restrict usages of the key, the CA can include the special KeyPurposeId anyExtendedKeyUsage in addition to the particular key purposes required by the applications.
class	ExtAiaAccessLocationMissing	RFC 5280: 4.2.2.1 An authorityInfoAccess extension may include multiple instances of the id-ad-caIssuers accessMethod.
class	ExtAiaMarkedCritical	Authority Information Access The authority information access extension indicates how to access information and services for the issuer of the certificate in which the extension appears.
class	ExtAuthorityKeyIdentifierCritical	RFC 5280: 4.2.1.1 Conforming CAs MUST mark this extension as non-critical.
class	ExtAuthorityKeyIdentifierNoKeyIdentifier	RFC 5280: 4.2.1.1 The keyIdentifier field of the authorityKeyIdentifier extension MUST be included in all certificates generated by conforming CAs to facilitate certification path construction.
class	ExtCertPolicyContainsNoticeref	The user notice has two optional fields: the noticeRef field and the explicitText field.
class	ExtCertPolicyDisallowedAnyPolicyQualifier	RFC 5280: 4.2.1.4 To promote interoperability, this profile RECOMMENDS that policy information terms consist of only an OID.
class	ExtCertPolicyDuplicate	The certificate policies extension contains a sequence of one or more policy information terms, each of which consists of an object identifier (OID) and optional qualifiers.
class	ExtCertPolicyExplicitTextIa5String	An explicitText field includes the textual statement directly in the certificate.
class	ExtCertPolicyExplicitTextIncludesControl	An explicitText field includes the textual statement directly in the certificate.
class	ExtCertPolicyExplicitTextNotNfc	When the UTF8String encoding is used, all character sequences SHOULD be normalized according to Unicode normalization form C (NFC) [NFC].
class	ExtCertPolicyExplicitTextNotUtf8	https://tools.ietf.org/html/rfc6818#section-3 An explicitText field includes the textual statement directly in the certificate.
class	ExtCertPolicyExplicitTextTooLong	An explicitText field includes the textual statement directly in the certificate.
class	ExtCrlDistributionMarkedCritical	The CRL distribution points extension identifies how CRL information is obtained.
class	ExtDuplicateExtension	"A certificate MUST NOT include more than one instance of a particular extension."
class	ExtFreshestCrlMarkedCritical	The freshest CRL extension identifies how delta CRL information is obtained.
class	ExtIanCritical	Issuer Alternative Name As with Section 4.2.1.6, this extension is used to associate Internet style identities with the certificate issuer.
class	ExtIanDnsNotIa5String	RFC 5280: 4.2.1.7 When the subjectAltName extension contains a domain name system label, the domain name MUST be stored in the DNSName (an IA5String).
class	ExtIanEmptyName	RFC 5280: 4.2.1.7 If the subjectAltName extension is present, the sequence MUST contain at least one entry.
class	ExtIanNoEntries	RFC 5280: 4.2.1.7 If the issuerAltName extension is present, the sequence MUST contain at least one entry.
class	ExtIanRfc822FormatInvalid	RFC 5280: 4.2.1.6 When the issuerAltName extension contains an Internet mail address, the address MUST be stored in the rfc822Name.
class	ExtIanSpaceDnsName	RFC 5280: 4.2.1.7 When the issuerAltName extension contains a domain name system label, the domain name MUST be stored in the dNSName (an IA5String).
class	ExtIanUriFormatInvalid	The name MUST include both a scheme (e.g., "http" or "ftp") and a scheme-specific-part.
class	ExtIanUriNotIa5	When the issuerAltName extension contains a URI, the name MUST be stored in the uniformResourceIdentifier (an IA5String).
class	ExtIanUriRelative	When the issuerAltName extension contains a URI, the name MUST be stored in the uniformResourceIdentifier (an IA5String).
class	ExtKeyUsageCertSignWithoutCa	RFC 5280: 4.2.1.9 The cA boolean indicates whether the certified public key may be used to verify certificate signatures.
class	ExtKeyUsageNotCritical
class	ExtKeyUsageWithoutBits	This profile does not restrict the combinations of bits that may be set in an instantiation of the keyUsage extension.
class	ExtNameConstraintsNotCritical	Restrictions are defined in terms of permitted or excluded name subtrees.
class	ExtNameConstraintsNotInCa	RFC 5280: 4.2.1.10 The name constraints extension, which MUST be used only in a CA certificate, indicates a name space within which all subject names in subsequent certificates in a certification path MUST be located.
class	ExtPolicyConstraintsEmpty	RFC 5280: 4.2.1.11 Conforming CAs MUST NOT issue certificates where policy constraints is an empty sequence.
class	ExtPolicyConstraintsNotCritical	RFC 5280: 4.2.1.11 Conforming CAs MUST mark this extension as critical.
class	ExtPolicyMapAnyPolicy	RFC 5280: 4.2.1.5 Each issuerDomainPolicy named in the policy mappings extension SHOULD also be asserted in a certificate policies extension in the same certificate.
class	ExtPolicyMapNotCritical	RFC 5280: 4.2.1.5.
class	ExtPolicyMapNotInCertPolicy	RFC 5280: 4.2.1.5 Each issuerDomainPolicy named in the policy mapping extension SHOULD also be asserted in a certificate policies extension in the same certificate.
class	ExtSanDnsNameTooLong
class	ExtSanDnsNotIa5String	RFC 5280: 4.2.1.6 When the subjectAltName extension contains a domain name system label, the domain name MUST be stored in the dNSName (an IA5String).
class	ExtSanEmptyName	RFC 5280: 4.2.1.6 If the subjectAltName extension is present, the sequence MUST contain at least one entry.
class	ExtSanNoEntries	RFC 5280: 4.2.1.6 If the subjectAltName extension is present, the sequence MUST contain at least one entry.
class	ExtSanNotCriticalWithoutSubject	RFC 5280: 4.2.1.6 Further, if the only subject identity included in the certificate is an alternative name form (e.g., an electronic mail address), then the subject distinguished name MUST be empty (an empty sequence), and the subjectAltName extension MUST be present.
class	ExtSanRfc822FormatInvalid	RFC 5280: 4.2.1.6 When the subjectAltName extension contains an Internet mail address, the address MUST be stored in the rfc822Name.
class	ExtSanSpaceDnsName	RFC 5280: 4.2.1.6 When the subjectAltName extension contains a domain name system label, the domain name MUST be stored in the dNSName (an IA5String).
class	ExtSanUriFormatInvalid	The name MUST include both a scheme (e.g., "http" or "ftp") and a scheme-specific-part.
class	ExtSanUriNotIa5	When the subjectAltName extension contains a URI, the name MUST be stored in the uniformResourceIdentifier (an IA5String).
class	ExtSanUriRelative	When the subjectAltName extension contains a URI, the name MUST be stored in the uniformResourceIdentifier (an IA5String).
class	ExtSubjectDirectoryAttrCritical	RFC 5280: 4.2.1.8 The subject directory attributes extension is used to convey identification attributes (e.g., nationality) of the subject.
class	ExtSubjectKeyIdentifierCritical	RFC 5280: 4.2.1.2 Conforming CAs MUST mark this extension as non-critical.
class	ExtSubjectKeyIdentifierMissingCa	To facilitate certification path construction, this extension MUST appear in all conforming CA certificates, that is, all certificates including the basic constraints extension (Section 4.2.1.9) where the value of cA is TRUE.
class	ExtSubjectKeyIdentifierMissingSubCert	To facilitate certification path construction, this extension MUST appear in all conforming CA certificates, that is, all certificates including the basic constraints extension (Section 4.2.1.9) where the value of cA is TRUE.
class	GeneralizedTimeIncludesFractionSeconds	4.1.2.5.2.
class	GeneralizedTimeNotInZulu	4.1.2.5.2.
class	IncorrectKuEncoding
class	InhibitAnyPolicyNotCritical	4.2.1.14.
class	InternationalDnsNameNotUnicode
class	IssuerDnCountryNotPrintableString
class	IssuerFieldEmpty	RFC 5280: 4.1.2.4 The issuer field identifies the entity that has signed and issued the certificate.
class	KeyUsageAndExtendedKeyUsageInconsistent
class	KeyUsageIncorrectLength
class	NameConstraintEmpty	Restrictions are defined in terms of permitted or excluded name subtrees.
class	NameConstraintMaximumNotAbsent	RFC 5280: 4.2.1.10 Within this profile, the minimum and maximum fields are not used with any name forms, thus, the minimum MUST be zero, and maximum MUST be absent.
class	NameConstraintMinimumNonZero	RFC 5280: 4.2.1.10 Within this profile, the minimum and maximum fields are not used with any name forms, thus, the minimum MUST be zero, and maximum MUST be absent.
class	NameConstraintOnEdiPartyName	RFC 5280: 4.2.1.10 Restrictions are defined in terms of permitted or excluded name subtrees.
class	NameConstraintOnRegisteredId	RFC 5280: 4.2.1.10 Restrictions are defined in terms of permitted or excluded name subtrees.
class	NameConstraintOnX400	RFC 5280: 4.2.1.10 Restrictions are defined in terms of permitted or excluded name subtrees.
class	PathLenConstraintImproperlyIncluded	RFC 5280: 4.2.1.9 CAs MUST NOT include the pathLenConstraint field unless the cA boolean is asserted and the key usage extension asserts the keyCertSign bit.
class	PathLenConstraintZeroOrLess	The pathLenConstraint field is meaningful only if the cA boolean is asserted and the key usage extension, if present, asserts the keyCertSign bit (Section 4.2.1.3).
class	RfcDnsNameEmptyLabel
class	RfcDnsnameHyphenInSld
class	RfcDnsnameLabelTooLong
class	RfcDnsnameUnderscoreInSld
class	RfcDnsnameUnderscoreInTrd
class	RsaAllowedKuCa	RFC 3279: 2.3.1 RSA Keys If the keyUsage extension is present in a CA or CRL issuer certificate which conveys an RSA public key, any combination of the following values MAY be present: digitalSignature; nonRepudiation; keyEncipherment; dataEncipherment; keyCertSign; and cRLSign.
class	RsaAllowedKuEe	RFC 3279: 2.3.1 RSA Keys If the keyUsage extension is present in an end entity certificate which conveys an RSA public key, any combination of the following values MAY be present: digitalSignature; nonRepudiation; keyEncipherment; and dataEncipherment.
class	RsaAllowedKuNoEnciphermentCa	RFC 3279: 2.3.1 RSA Keys If the keyUsage extension is present in a CA or CRL issuer certificate which conveys an RSA public key, any combination of the following values MAY be present: digitalSignature; nonRepudiation; keyEncipherment; dataEncipherment; keyCertSign; and cRLSign.
class	SerialNumberLongerThan20Octets	RFC 5280: 4.1.2.2.
class	SerialNumberNotPositive	4.1.2.2.
class	SpkiRsaEncryptionParameterNotNull	"RFC5280: RFC 4055, Section 1.2" RSA: Encoded algorithm identifier MUST have NULL parameters.
class	SubjectCommonNameMaxLength	RFC 5280: A.1 In this Appendix, there is a list of upperbounds for fields in a x509 Certificate. * ub-common-name INTEGER ::= 64
class	SubjectDnCountryNotPrintableString
class	SubjectDnNotPrintableCharacters
class	SubjectDnSerialNumberMaxLength
class	SubjectDnSerialNumberNotPrintableString
class	SubjectEmailMaxLength	RFC 5280: A.1 In this Appendix, there is a list of upperbounds for fields in a x509 Certificate. * ub-emailaddress-length INTEGER ::= 128 The ASN.1 modules in Appendix A are unchanged from RFC 3280, except that ub-emailaddress-length was changed from 128 to 255 in order to align with PKCS #9 [RFC2985].
class	SubjectEmptyWithoutSan	RFC 5280: 4.2 & 4.2.1.6 Further, if the only subject identity included in the certificate is an alternative name form (e.g., an electronic mail address), then the subject distinguished name MUST be empty (an empty sequence), and the subjectAltName extension MUST be present.
class	SubjectGivenNameMaxLength	RFC 5280: A.1 -- Naming attributes of type X520name id-at-givenName AttributeType ::= { id-at 42 } -- Naming attributes of type X520Name: -- X520name ::= DirectoryString (SIZE (1..ub-name)) -- -- Expanded to avoid parameterized type: X520name ::= CHOICE { teletexString TeletexString (SIZE (1..ub-name)), printableString PrintableString (SIZE (1..ub-name)), universalString UniversalString (SIZE (1..ub-name)), utf8String UTF8String (SIZE (1..ub-name)), bmpString BMPString (SIZE (1..ub-name)) } -- specifications of Upper Bounds MUST be regarded as mandatory -- from Annex B of ITU-T X.411 Reference Definition of MTS Parameter -- Upper Bounds -- Upper Bounds ub-name INTEGER ::= 32768
class	SubjectGivenNameRecommendedMaxLength	RFC 5280: A.1 -- specifications of Upper Bounds MUST be regarded as mandatory -- from Annex B of ITU-T X.411 Reference Definition of MTS Parameter -- Upper Bounds
class	SubjectInfoAccessMarkedCritical	The subject information access extension indicates how to access information and services for the subject of the certificate in which the extension appears.
class	SubjectLocalityNameMaxLength	RFC 5280: A.1 In this Appendix, there is a list of upperbounds for fields in a x509 Certificate. * ub-locality-name INTEGER ::= 128
class	SubjectNotDn	RFC 5280: 4.1.2.6 Where it is non-empty, the subject field MUST contain an X.500 distinguished name (DN).
class	SubjectOrganizationalUnitNameMaxLength	RFC 5280: A.1 In this Appendix, there is a list of upperbounds for fields in a x509 Certificate. * ub-organizational-unit-name INTEGER ::= 64
class	SubjectOrganizationNameMaxLength	RFC 5280: A.1 In this Appendix, there is a list of upperbounds for fields in a x509 Certificate. * ub-organization-name INTEGER ::= 64
class	SubjectPostalCodeMaxLength	RFC 5280: A.1 In this Appendix, there is a list of upperbounds for fields in a x509 Certificate. * ub-postal-code-length INTEGER ::= 16
class	SubjectPrintableStringBadalpha
class	SubjectStateNameMaxLength	RFC 5280: A.1 In this Appendix, there is a list of upperbounds for fields in a x509 Certificate. * ub-state-name INTEGER ::= 128
class	SubjectStreetAddressMaxLength	ITU-T X.520 (02/2001) UpperBounds ub-street-address INTEGER ::= 128
class	SubjectSurnameMaxLength	RFC 5280: A.1 -- Naming attributes of type X520name id-at-surname AttributeType ::= { id-at 4 } -- Naming attributes of type X520Name: -- X520name ::= DirectoryString (SIZE (1..ub-name)) -- -- Expanded to avoid parameterized type: X520name ::= CHOICE { teletexString TeletexString (SIZE (1..ub-name)), printableString PrintableString (SIZE (1..ub-name)), universalString UniversalString (SIZE (1..ub-name)), utf8String UTF8String (SIZE (1..ub-name)), bmpString BMPString (SIZE (1..ub-name)) } -- specifications of Upper Bounds MUST be regarded as mandatory -- from Annex B of ITU-T X.411 Reference Definition of MTS Parameter -- Upper Bounds -- Upper Bounds ub-name INTEGER ::= 32768
class	SubjectSurnameRecommendedMaxLength	RFC 5280: A.1 -- specifications of Upper Bounds MUST be regarded as mandatory -- from Annex B of ITU-T X.411 Reference Definition of MTS Parameter -- Upper Bounds
class	SuperfluousKuEncoding
class	TbsSignatureRsaEncryptionParameterNotNull
class	WrongTimeFormatPre2050	CAs conforming to this profile MUST always encode certificate validity dates through the year 2049 as UTCTime; certificate validity dates in 2050 or later MUST be encoded as GeneralizedTime.