KB Article #175905
Error 255: Unidentified error from vatest
Problem
* The vatest tool reports error 255 (unidentified error) when attempting to validate responses. For example:
vatest scvp -checkcert <EE cert> "" -ignoreresponsesign -url <VA server>
path revocation status: good
vatest scvp -checkcert <EE cert> "" -servercerts va.cer -url <VA server>
Error 255: Unidentified error.
Resolution
-- The client needs the issuer of the signing certificate in order to validate the signature from VA.For example, if you are executing vatest, you would provide these options:
vatest scvp -checkcert <EE cert> "" -url <VA server url> -servercerts <Cert of Issuer of VA Signing Cert>
A couple of additional things to bear in mind:
The client also fails to validate the response from the VA server when the signing certificate is issued by a 3rd party CA and the certificate:
a) is missing the “emailProtection” extendedKeyUsage,
b) has the keyUsage as critical and it is missing the “digitalSignature”. If KeyUsage is not present, it's OK.
Same on all platforms.