Cert Chain Invalid - 证书链校验失败 —— 中间证书缺失、根不受信、链序错误或链部署不完整

Go back Parent node: Certificate Alarm - 证书告警子树 —— 到期预警 10-19、已过期 20-29、吊销校验异常 30-59、CA 与信任链异常 60-99 (1.3.6.1.4.1.59719.0.3)

Technical information

Dot notation:	`1.3.6.1.4.1.59719.0.3.90`
ASN.1 notation:	`{ iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) tsingyao(59719) notifications(0) certificate-alarm(3) cert-chain-invalid(90) }`
OID-IRI notation:	`/ISO/Identified-Organization/6/1/4/1/TsingYao/Notifications/CertificateAlarm/CertChainInvalid`
WEID notation:	`weid:P-1A2V-0-3-2I-4`
DER encoding:	`06:0B:2B:06:01:04:01:83:D2:47:00:03:5A`

Description

English:
Certificate chain validation failed. The certificate chain cannot be built to a trusted trust anchor, which is usually caused by a missing intermediate certificate, an untrusted root certificate, an incorrect chain order or incomplete chain deployment.
Recommended severity: critical. Recommended handling: deploy the complete intermediate certificate chain on the server, check the trust anchor configuration and the certificate chain order, and verify that the leaf certificate matches the deployed private key.
Status: registered but unused. Not yet emitted by any monitoring component; when implemented, carry the leaf certificate identifier, the trust point used and the failure reason code. The unused state shall be re-verified at each revision of this file.
Recommendation: validate the chain from the trust point table (1.3.6.1.4.1.59719.6.1.4) after every deployment, and test with an external client to detect missing intermediate certificates that internal tools may tolerate.
See also: 1.3.6.1.4.1.59719.6.1.4, 1.3.6.1.4.1.59719.0.1.5, 1.3.6.1.4.1.59719.5.100.
Verification: 2026-10-22 — this arc and all its sub-ordinates are confirmed unused; re-verify the unused state at each revision of this file.

中文:
证书链校验失败。证书链无法构建到可信信任锚，通常由中间证书缺失、根证书不受信、链顺序错误或链部署不完整导致。
建议级别：紧急。处理建议：在服务端部署完整的中间证书链，核查信任锚配置与证书链顺序，并确认叶子证书与已部署私钥匹配。
状态：已注册但未使用。尚无监控组件上报该告警；实现时应携带叶子证书标识、所使用信任点与失败原因码。本文件每次修订时须重新核验该未使用状态。
建议：每次部署后依据信任点表（1.3.6.1.4.1.59719.6.1.4）校验链路，并使用外部客户端测试，以发现内部工具可能容忍的中间证书缺失问题。
关联节点：1.3.6.1.4.1.59719.6.1.4、1.3.6.1.4.1.59719.0.1.5、1.3.6.1.4.1.59719.5.100。
核验：2026-10-22 —— 本弧及其全部下级标识均确认未使用，本文件每次修订时须重新核验该未使用状态。

Registration Authority

tsingyao
E-Mail: op@tsingyao.net
JunQing Gu
TsingYao Technology Limited

The RA does not want to publish their personal information.

Subordinate objects

ID	Base36	ASN.1 IDs (comma sep.)	IRI IDs (comma sep.)	RA	Comment	Created	Updated
No items available

Alternative Identifiers

Identifier	Description
aid:D276000186B200054278A5EC5C951BF6 (No PIX allowed)	OIDplus Information Object Application Identifier (ISO/IEC 7816)
guid:4278a5ec-0000-8000-a6d3-7a541fec7a4f	OIDplus Information Object Custom UUID (RFC 9562)
guid:b8aacd7f-9fc1-3db4-93fd-c40039d928b8	Name based version 3 / MD5 UUID with namespace UUID_NAMEBASED_NS_OID
guid:7190f7a8-fced-5c91-b559-002528143184	Name based version 5 / SHA1 UUID with namespace UUID_NAMEBASED_NS_OID
mac:02-CF-DC-95-1B-F6	OIDplus Information Object MAC address, Unicast (AAI)
mac:03-CF-DC-95-1B-F6	OIDplus Information Object MAC address, Multicast (AAI)
weid:P-1A2V-0-3-2I-4	WEID notation
x500dn:/dc=com/dc=example/cn=oidplus/1.3.6.1.4.1.37476.2.5.2.9.4.1=1115203052/1.3.6.1.4.1.37476.2.5.2.9.4.2=1553275894	OIDplus Information Object X.500 DN