A chain of PEM blocks or a token, and what mooncred makes of it: every field it parsed, the path it built to a trust anchor, and the sentence it refuses with when it refuses. The reading is not repeated here — the page loads this library compiled to JavaScript, the same code the tests cover.
Every refusal carries the position of the certificate it is about, counting the leaf as zero, so a chain of four says which of them failed rather than that one did. These are the kinds a chain can come back with.
MalformedThe certificate does not parse, or parses into something other than one certificate.ExpiredIts notAfter is behind the instant the chain is judged at.PrematureIts notBefore is ahead of that instant.IssuerNothing among the intermediates or the anchors is named as its issuer.AuthorityAn issuer is not a CA, has no keyCertSign, or sits deeper than its pathLenConstraint.SignatureThe issuer's signature does not verify over the bytes that arrived.DepthMore intermediates than the policy allows.BudgetMore signature checks than the policy allows — a pile of cross-signed certificates ran it out.HostThe leaf names no such host: subjectAltName only, never the commonName.PurposeThe leaf, or an issuer that restricts its purposes, does not allow the one asked for.CriticalA critical extension the validator does not understand.ConstraintA name falls outside a name constraint above it.AlgorithmA signature algorithm this validator does not check.WeakAn RSA key below the policy's bit count signed something on the path.KeyUsageA key that can only sign says it enciphers or agrees on a key, which RFC 9881 §5 forbids.The page keeps the library's own words: the sentence beside each verdict is the one Refused prints.