| Previous | Next |
| CRYPT_E_ASN1_LARGE | CRYPT_E_ASN1_MEMORY |
CRYPT_E_ASN1_CONSTRAINT
Syntax can decode while the value remains invalid
CRYPT_E_ASN1_CONSTRAINT means the tag and length were readable, but the resulting value violates a constraint attached to the ASN.1 type. Constraints can restrict numeric ranges, collection sizes, string alphabets, permitted alternatives, or the number of bits and octets in a field.
This distinction is important when comparing it with CRYPT_E_ASN1_CORRUPT. Corrupt data cannot be parsed structurally; a constraint failure may be structurally well-formed yet impossible for the schema. Re-encoding the same decoded value will not make it valid unless the offending value is corrected.
Diagnostic steps
- Identify the exact field, not only the top-level certificate or request.
- Compare its decoded value with the SIZE, range, or alphabet constraint.
- Check whether the producer used a newer or different ASN.1 schema.
- Avoid disabling validation for untrusted data; constraints frequently enforce security-relevant bounds.
References
- ITU-T X.680: ASN.1 constraints
- ITU-T X.690: encoding constrained values
- Microsoft: CryptDecodeObjectEx
Looking for a different code? Search another status or error code.