| Previous | Next |
| CERT_E_INVALID_POLICY | INET_E_INVALID_URL |
CERT_E_INVALID_NAME
CERT_E_INVALID_NAME means that name-constraints processing rejected a certificate name. The relevant name is either outside a permitted subtree or appears in an explicitly excluded subtree defined by a CA certificate in the path.
Trace name constraints through the chain
- Identify the certificate name that failed and the CA certificate that supplied the relevant Name Constraints extension.
- Compare the requested service or subject name with permitted and excluded subtrees in the chain.
- Reissue the certificate or correct the CA policy when the intended name is outside the authorized namespace.
This is not fixed by adding the leaf certificate to a trust store because the CA constraints still apply to the path.
Microsoft: certificate chain policy status
Looking for a different code? Search another status or error code.