There should be a plus sign when constructing the result code from MBEDTLS_ERR_PK_INVALID_PUBKEY + MBEDTLS_ERR_ASN1_LENGTH_MISMATCH at the end of mbedtls_pk_parse_subpubkey(). https://github.com/ARMmbed/mbedtls/blob/9c99dc862cd5cf9cdc62cbfcd200063c83295397/library/pkparse.c#L670 ...