What causes "Improperly formatted distinguished name" in NationalSecurityAgency/ghidra?

Use valid RFC 2253 syntax: comma-separated key=value pairs.

NationalSecurityAgency/ghidra · error · IllegalArgumentException

Improperly formatted distinguished name

Error message

Improperly formatted distinguished name

What it means

Thrown by validateDistinguishedName's catch-all when constructing LdapName or iterating its RDNs raises any Exception (e.g. malformed DN syntax, bad escaping, invalid characters). It is a broad safety net wrapping any parsing failure.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java:429

	private void validateDistinguishedName() throws IllegalArgumentException {
		if (distinguishedName == null) {
			return;
		}
		commonName = null;
		try {
			LdapName ldapName = new LdapName(distinguishedName);
			for (Rdn rdn : ldapName.getRdns()) {
				if (rdn.getType().equalsIgnoreCase("CN")) {
					commonName = rdn.getValue().toString();
					break;
				}
			}
			if (commonName == null) {
				throw new IllegalArgumentException("Missing common name attribute");
			}
		}
		catch (Exception e) {
			throw new IllegalArgumentException("Improperly formatted distinguished name");
		}
	}

	/**
	 * @return true if the server (referred to by -postgresRoot-) is running
	 * @throws IOException if there is a problem running the command
	 * @throws InterruptedException if there is a problem running the command
	 */
	private boolean isServerRunning() throws IOException, InterruptedException {
		File createCommand = new File(postgresRoot, "bin/pg_isready");
		List<String> command = new ArrayList<String>();
		command.add(createCommand.getAbsolutePath());
		if ((port != -1) && (port != 5432)) {	// Non-default port
			command.add("-p");
			command.add(Integer.toString(port));
		}
		int ret = runCommand(null, command, loadLibraryVar, loadLibraryValue);
		return (ret == 0);

View on GitHub (pinned to d5f144c24d)

Solutions

Use valid RFC 2253 syntax: comma-separated key=value pairs.
Escape special characters (comma, plus, equals, quotes) per RFC 2253.
Test the DN with an LDAP/LdapName parser before passing it.

Example fix

// before
bsim control configure host --auth pki --dn "CN=server;O=Acme"
// after
bsim control configure host --auth pki --dn "CN=server,O=Acme"

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-parse the DN with javax.naming.ldap.LdapName to catch syntax errors early.
try {
    new javax.naming.ldap.LdapName(dn);
} catch (javax.naming.InvalidNameException e) {
    System.err.println("Malformed DN: " + dn + " (" + e.getMessage() + ")");
    return;
}

Try / catch

try {
    launchable.validateDistinguishedName();
} catch (IllegalArgumentException e) {
    if (e.getMessage().equals("Improperly formatted distinguished name")) {
        System.err.println("DN must be RFC 2253 syntax (comma-separated key=value).");
    }
    throw e;
}

Prevention

Pre-parse DNs with LdapName to surface syntax errors before launch.
Escape special characters (, + = " \) per RFC 2253.
Use commas, not semicolons or spaces, as RDN separators.

When it happens

Trigger: Passing a DN that violates RFC 2253 syntax, e.g. unescaped special characters, wrong separators, or garbage like `--dn "CN=server;O=Acme"` (semicolon instead of comma).

Common situations: Bad escaping of commas/plus/equals inside values, stray punctuation, or using semicolons/spaces as separators.

Related errors

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/f1163e57ab557690. Report an issue: GitHub.