| Previous | Next |
| CRYPT_E_ASN1_BADREAL | CRYPT_E_ASN1_CHOICE |
CRYPT_E_ASN1_BADTAG
The identifier octets name the wrong type
CRYPT_E_ASN1_BADTAG occurs when the decoder expects one ASN.1 tag but reads another. The mismatch may involve the tag class, constructed bit, or tag number. It often pinpoints a wrong object selector, an omitted explicit wrapper, an incorrectly encoded CHOICE alternative, or damage that shifted parsing to the wrong byte offset.
A valid tag can still be wrong for its position. For example, an OCTET STRING containing an extension value is not interchangeable with the decoded structure inside that octet string; the outer layer must be removed before the inner type is decoded.
How to localize the mismatch
- Record the expected and observed tag at the failing offset.
- Check explicit versus implicit tagging in the ASN.1 definition.
- Verify that the caller selected the correct top-level structure type.
- Decode nested OCTET STRING and BIT STRING wrappers one layer at a time.
References
- ITU-T X.690: identifier octets and tagging
- Microsoft: supported CryptoAPI object structures
- RFC 5280: certificate and extension ASN.1 modules
Looking for a different code? Search another status or error code.