bad_certificate
bad_certificate (42) is sent when a certificate is corrupt, has an invalid signature, or cannot be parsed. This is distinct from certificate_expired (45) or certificate_revoked (44) – bad_certificate means the certificate itself is malformed or its cryptographic signature does not verify, not that it is merely out of date.
Alert Code
42
Level
Fatal
Standard
RFC 8446
Description
bad_certificate covers malformed certificates and signature verification failures. A certificate signature is invalid if it was not signed by the claimed CA, if the certificate was tampered with, or if there is a parsing error. This can occur during initial TLS setup when deploying a new certificate that was not properly generated, or when a certificate chain is assembled incorrectly. Use 'openssl verify' to check certificate validity before deployment.
Common Causes
- –Certificate signature does not verify against the claimed CA
- –Certificate DER/PEM encoding is malformed
- –Certificate chain assembled in wrong order
- –Certificate was generated with incompatible parameters
- –Self-signed certificate presented to a client that requires CA-signed certs