The CERT_TRUST_STATUS structure contains trust information about a certificate in a certificate chain, summary trust information about a simple chain of certificates, or summary information about an array of simple chains.

Syntax

typedef struct _CERT_TRUST_STATUS {
  DWORD dwErrorStatus;
  DWORD dwInfoStatus;
}CERT_TRUST_STATUS, *PCERT_TRUST_STATUS;

Members

dwErrorStatus

The following error status codes are defined for certificates and chains.

Value	Meaning
CERT_TRUST_NO_ERROR 0x00000000	No error found for this certificate or chain.
CERT_TRUST_IS_NOT_TIME_VALID 0x00000001	This certificate or one of the certificates in the certificate chain is not time valid.
CERT_TRUST_IS_NOT_TIME_NESTED 0x00000002	Certificates in the chain are not properly time nested.
CERT_TRUST_IS_REVOKED 0x00000004	Trust for this certificate or one of the certificates in the certificate chain has been revoked.
CERT_TRUST_IS_NOT_SIGNATURE_VALID 0x00000008	The certificate or one of the certificates in the certificate chain does not have a valid signature.
CERT_TRUST_IS_NOT_VALID_FOR_USAGE 0x00000010	The certificate or certificate chain is not valid for its proposed usage.
CERT_TRUST_IS_UNTRUSTED_ROOT 0x00000020	The certificate or certificate chain is based on an untrusted root.
CERT_TRUST_REVOCATION_STATUS_UNKNOWN 0x00000040	The revocation status of the certificate or one of the certificates in the certificate chain is unknown.
CERT_TRUST_IS_CYCLIC 0x00000080	One of the certificates in the chain was issued by a certification authority that the original certificate had certified.
CERT_TRUST_INVALID_EXTENSION 0x00000100	One of the certificates has an extension that is not valid.
CERT_TRUST_INVALID_POLICY_CONSTRAINTS 0x00000200	The certificate or one of the certificates in the certificate chain has a policy constraints extension, and one of the issued certificates has a disallowed policy mapping extension or does not have a required issuance policies extension.
CERT_TRUST_INVALID_BASIC_CONSTRAINTS 0x00000400	The certificate or one of the certificates in the certificate chain has a basic constraints extension, and either the certificate cannot be used to issue other certificates, or the chain path length has been exceeded.
CERT_TRUST_INVALID_NAME_CONSTRAINTS 0x00000800	The certificate or one of the certificates in the certificate chain has a name constraints extension that is not valid.
CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT 0x00001000	The certificate or one of the certificates in the certificate chain has a name constraints extension that contains unsupported fields. The minimum and maximum fields are not supported. Thus minimum must always be zero and maximum must always be absent. Only UPN is supported for an Other Name. The following alternative name choices are not supported: X400 Address EDI Party Name Registered Id
CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT 0x00002000	The certificate or one of the certificates in the certificate chain has a name constraints extension and a name constraint is missing for one of the name choices in the end certificate.
CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT 0x00004000	The certificate or one of the certificates in the certificate chain has a name constraints extension, and there is not a permitted name constraint for one of the name choices in the end certificate.
CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT 0x00008000	The certificate or one of the certificates in the certificate chain has a name constraints extension, and one of the name choices in the end certificate is explicitly excluded.
CERT_TRUST_IS_OFFLINE_REVOCATION 0x01000000	The revocation status of the certificate or one of the certificates in the certificate chain is either offline or stale.
CERT_TRUST_NO_ISSUANCE_CHAIN_POLICY 0x02000000	The end certificate does not have any resultant issuance policies, and one of the issuing certification authority certificates has a policy constraints extension requiring it.
CERT_TRUST_IS_EXPLICIT_DISTRUST 0x04000000	The certificate is explicitly distrusted. Windows Server 2003, Windows XP, and Windows 2000:  This flag is not supported.
CERT_TRUST_HAS_NOT_SUPPORTED_CRITICAL_EXT 0x08000000	The certificate does not support a critical extension. Windows Server 2003, Windows XP, and Windows 2000:  This flag is not supported.

 

The following codes are defined for chains only.

Value	Meaning
CERT_TRUST_IS_PARTIAL_CHAIN 0x00010000	The certificate chain is not complete.
CERT_TRUST_CTL_IS_NOT_TIME_VALID 0x00020000	A certificate trust list (CTL) used to create this chain was not time valid.
CERT_TRUST_CTL_IS_NOT_SIGNATURE_VALID 0x00040000	A CTL used to create this chain did not have a valid signature.
CERT_TRUST_CTL_IS_NOT_VALID_FOR_USAGE 0x00080000	A CTL used to create this chain is not valid for this usage.

 

dwInfoStatus

The following information status codes are defined.

Value	Meaning
CERT_TRUST_HAS_EXACT_MATCH_ISSUER 0x00000001	An exact match issuer certificate has been found for this certificate. This status code applies to certificates only.
CERT_TRUST_HAS_KEY_MATCH_ISSUER 0x00000002	A key match issuer certificate has been found for this certificate. This status code applies to certificates only.
CERT_TRUST_HAS_NAME_MATCH_ISSUER 0x00000004	A name match issuer certificate has been found for this certificate. This status code applies to certificates only.
CERT_TRUST_IS_SELF_SIGNED 0x00000008	This certificate is self-signed. This status code applies to certificates only.
CERT_TRUST_HAS_PREFERRED_ISSUER 0x00000100	The certificate or chain has a preferred issuer. This status code applies to certificates and chains.
CERT_TRUST_HAS_ISSUANCE_CHAIN_POLICY 0x00000400	An issuance chain policy exists. This status code applies to certificates and chains.
CERT_TRUST_HAS_VALID_NAME_CONSTRAINTS 0x00000400	A valid name constraints for all namespaces, including UPN. This status code applies to certificates and chains.
CERT_TRUST_IS_PEER_TRUSTED 0x00000800	This certificate is peer trusted. This status code applies to certificates only. Windows Server 2003, Windows XP, and Windows 2000:  This flag is not supported.
CERT_TRUST_HAS_CRL_VALIDITY_EXTENDED 0x00001000	This certificate's certificate revocation list (CRL) validity has been extended. This status code applies to certificates only. Windows Server 2003, Windows XP, and Windows 2000:  This flag is not supported.
CERT_TRUST_IS_FROM_EXCLUSIVE_TRUST_STORE 0x00002000	The certificate was found in either a store pointed to by the hExclusiveRoot or hExclusiveTrustedPeople member of the CERT_CHAIN_ENGINE_CONFIG structure. Windows Server 2008, Windows Vista, Windows Server 2003, Windows XP, and Windows 2000:  This flag is not supported.
CERT_TRUST_IS_COMPLEX_CHAIN 0x00010000	The certificate chain created is a complex chain. This status code applies to chains only.

 

Requirements

See Also

CERT_CHAIN_CONTEXT

CERT_SIMPLE_CHAIN

Send comments about this topic to Microsoft

Build date: 10/2/2009