Enum IssuanceError 

pub enum IssuanceError {
    InvalidCsr(String),
    KeyTooSmall {
        algorithm: String,
        bits: u32,
        min_bits: u32,
    },
    ValidityTooLong {
        requested_days: u32,
        max_days: u32,
    },
    MissingExtension(String),
    UnknownProfile(String),
    SigningError(String),
    StorageError(String),
    AlgorithmNotAllowed {
        algorithm: String,
        profile: String,
    },
    ProhibitedDnAttribute {
        oid: String,
        name: String,
    },
}

Errors during certificate issuance.

Variants

InvalidCsr(String)

The CSR is malformed or cannot be parsed.

KeyTooSmall

The CSR key does not meet minimum size requirements.

Fields

algorithm: String

bits: u32

min_bits: u32

ValidityTooLong

The requested validity period exceeds the maximum.

Fields

requested_days: u32

max_days: u32

MissingExtension(String)

A required extension is missing from the profile.

UnknownProfile(String)

The enrollment profile does not exist.

SigningError(String)

CA signing operation failed.

StorageError(String)

Database storage error.

AlgorithmNotAllowed

The CSR algorithm is not permitted by the enrollment profile.

Fields

algorithm: String

profile: String

ProhibitedDnAttribute

The CSR subject contains a prohibited DN attribute.

Fields

oid: String

name: String

Implementations

impl IssuanceError

pub fn is_client_error(&self) -> bool

Whether this failure was caused by the client’s request content (the CSR) rather than a server-side fault.

This is the single source of truth for HTTP/CoAP status classification: client-content faults must surface as 4xx (RFC 7030 §4.2.3 — the requester can fix the CSR and retry), while server/profile/signing faults must surface as 5xx (the client cannot fix them, and internal detail must not leak). A misclassification here would either blame the client for a server misconfiguration or hide a bad CSR behind a 500.

Note the two profile-driven variants — MissingExtension and ValidityTooLong — are server errors: they originate from the server’s EnrollmentProfile (check_required_extensions, check_validity_period), not from anything the client sent.

Trait Implementations

impl Debug for IssuanceError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for IssuanceError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for IssuanceError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<IssuanceError> for KipukaError

fn from(e: IssuanceError) -> Self

Classify an issuance failure into the correct HTTP domain.

A fault in the client-supplied CSR (bad self-signature/PoP, undersized key, disallowed algorithm, prohibited DN attribute) is a BadRequest → 400: the requester can fix the CSR and retry, and the specific reason is safe to return. Every other failure — signing, storage, or a server-side profile misconfiguration — is a Ca error → 500, whose detail is logged but never exposed to the client.

The client/server split is owned by IssuanceError::is_client_error so HTTP and CoAP transports classify identically.