certificate_unknown
certificate_unknown (46) is a catch-all alert for certificate problems not covered by more specific codes. The certificate was processed but rejected for an unspecified reason – the issuing CA is not trusted, a certificate constraint was violated, or a policy check failed that does not map to a named alert.
Alert Code
46
Level
Fatal
Standard
RFC 8446
Description
certificate_unknown covers certificate rejections that don't fit bad_certificate, expired, or revoked. The most common cause is an untrusted root CA – the server's certificate chain leads to a root CA not in the client's trust store. This is common in enterprise environments with internal PKI, development environments with self-signed certificates, or when a new CA root has not been added to the OS trust store. Browser-specific trust stores differ from OS trust stores.
Common Causes
- –Root CA not in client's trust store (internal/private CA)
- –Self-signed certificate not explicitly trusted
- –Intermediate certificate missing from the chain
- –Certificate pinning failure in the client application
- –Certificate policy constraint violation