| Previous | Next |
| CRYPT_E_ASN1_NYI | CRYPT_E_ASN1_NOEOD |
CRYPT_E_ASN1_EXTENDED
Unknown extensions were encountered
CRYPT_E_ASN1_EXTENDED reports that the decoder skipped extension data it did not understand. Extensibility allows newer schemas to add fields without changing every older decoder, but the security meaning depends on where the extension appears and whether the surrounding profile marks it critical.
For X.509 certificates, an unrecognized critical certificate extension must cause certificate-path validation to fail. A non-critical extension can be ignored by a relying party. The ASN.1 decoder's ability to skip bytes therefore does not by itself decide whether the certificate is acceptable for trust or policy evaluation.
What to record
- Capture the unknown extension OID and its critical flag.
- Separate successful structural decoding from later path-validation policy.
- Preserve the raw extension value for a newer or application-specific decoder.
- Do not automatically clear the critical flag or discard an extension before signature verification.
References
- RFC 5280: processing critical and non-critical extensions
- Microsoft: certificate extension decoding with CryptDecodeObjectEx
- ITU-T X.680: extensibility mechanisms
Looking for a different code? Search another status or error code.