---
title: "Exceptions"
description: "The exception of the certificate library, the errors of OpenSSL that it carries as translatable messages and how to translate them"
type: "docs"
category: "doc"
tags: []
authors: [Anonymous]
date: "2026-10-17"
last_update: "2026-10-17"
time_minutes: 4
draft: false
unlisted: false
url: "https://www.derafu.dev/docs/data/certificate/exceptions"
---

# Exceptions

Everything that fails in the library throws `Derafu\Certificate\Exception\CertificateException`, so one `catch` takes all of them. The messages are in English, and the library has their translation to Spanish.

## What the Exception Has

```php
use Derafu\Certificate\Exception\CertificateException;

try {
    $loader->loadFromData($data, 'wrong password');
} catch (CertificateException $e) {
    $e->getMessage(); // "It was not possible to read the digital certificate data. MAC verification failed in PKCS12, certificate or password is incorrect (Error #11800071)."

    foreach ($e->getErrors() as $error) {
        (string) $error; // "MAC verification failed in PKCS12, certificate or password is incorrect (Error #11800071)."
    }
}
```

- `getErrors()` gives the errors that explain the exception, as a list of **translatable messages** (`TranslatableInterface`): `(string)` gives each one in English, and `trans($translator)` in the language of the translator. It is an empty list if there are none.
- The exception does not look for its errors: it has the ones that it is given. The errors of OpenSSL are given by the [OpenSSL service](open-ssl), that takes the ones of each call, so an error of another call is never in an exception that is not its own.
- Some errors of OpenSSL are known (a wrong password, an invalid PEM, an algorithm that is not supported...). Each one is a message that a person understands, with the code of the error at the end: `... (Error #11800071).`, and has its translation.
- Any other error of OpenSSL, and a warning of PHP, is the text as OpenSSL (or PHP) says it, in the message `OpenSSL: {text}`. That text has no translation, so it is the same in every language.
- In `loadFromData()` the message has the errors, so it says what failed. In the rest of the exceptions the errors are only in `getErrors()`.

`CertificateException` has the usual `getCode()` and `getPrevious()`.

## When It Is Thrown

| Where | When |
|---|---|
| `CertificateLoader` | The file or the PKCS#12 can not be read, or the array has no certificate, no private key, or values that are not text. |
| `Certificate` | The certificate does not have the field (ID, name, email, issuer), its data or keys can not be read, there is no private key, or the key is not RSA (modulus and exponent). |
| `CertificateValidator` | The ID does not match the format, the certificate is expired, or the format is not a valid regular expression. |
| `SelfSignedCertificate` | OpenSSL can not generate a key or a certificate, or the CN, email or serial number is empty. |
| `AsymmetricKeyHelper` | The certificate or the private key is empty. |

`AsymmetricKeyHelper::generatePublicKeyFromModulusExponent()` throws a translatable `LogicException` if `phpseclib` is not installed.

## Translating the Messages

The exceptions are translatable (they are the ones of the `derafu/translation` library). To have a message in another language, use `trans()` with a translator:

```php
use Derafu\Certificate\Translation\CertificateTranslationResourceProvider;
use Derafu\Translation\TranslatorFactory;

$translator = TranslatorFactory::create('es', [], [new CertificateTranslationResourceProvider()]);

try {
    $loader->loadFromFile('/not/found.p12', 'password');
} catch (CertificateException $e) {
    echo $e->getMessage();       // "It was not possible to read the digital certificate file from /not/found.p12"
    echo $e->trans($translator); // "No fue posible leer el archivo del certificado digital desde /not/found.p12"
}
```

The errors are translated in the message and one by one. With a wrong password:

```php
$e->trans($translator);
// "No fue posible leer los datos del certificado digital. Falló la verificación MAC en el PKCS12, el certificado o la contraseña es incorrecta (Error #11800071)."

$e->getErrors()[0]->trans($translator);
// "Falló la verificación MAC en el PKCS12, el certificado o la contraseña es incorrecta (Error #11800071)."
```

The whole text is in the language of the translator: the sentence and the reason of the failure. The errors in the message are joined with `TranslatableList` of `derafu/translation`, as sentences, one after the other.

The translations are in `resources/translations/errors+intl-icu.es.php`. In an application with the Symfony container, `resources/config/certificate-services.yaml` registers `CertificateTranslationResourceProvider` with the tag `derafu_translation.resource_provider`, so its translations are loaded with the ones of the other libraries.

The errors of OpenSSL that are not known, and the warnings of PHP, are the text of OpenSSL or PHP (`OpenSSL: error:0680008E:asn1 encoding routines::not enough data`), and have no translation: they are technical information, and they are as they are in any language.



---
Last updated on 17/10/2026