NationalSecurityAgency/ghidra · error · IllegalArgumentException

Missing common name attribute

Error message

Missing common name attribute

What it means

Thrown by validateDistinguishedName when the --dn LDAP distinguished name parses successfully (via LdapName) but contains no CN (commonName) RDN. PKI authentication setup requires a CN to build the certificate subject, so its absence is fatal.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java:425

	 * X509 certificate distinguished name. Try to extract the common name portion of the
	 * distinguished name and assign it to -commonName- 
	 * @throws IllegalArgumentException if the distinguished name is improperly formatted or the common name is missing
	 */
	private void validateDistinguishedName() throws IllegalArgumentException {
		if (distinguishedName == null) {
			return;
		}
		commonName = null;
		try {
			LdapName ldapName = new LdapName(distinguishedName);
			for (Rdn rdn : ldapName.getRdns()) {
				if (rdn.getType().equalsIgnoreCase("CN")) {
					commonName = rdn.getValue().toString();
					break;
				}
			}
			if (commonName == null) {
				throw new IllegalArgumentException("Missing common name attribute");
			}
		}
		catch (Exception e) {
			throw new IllegalArgumentException("Improperly formatted distinguished name");
		}
	}

	/**
	 * @return true if the server (referred to by -postgresRoot-) is running
	 * @throws IOException if there is a problem running the command
	 * @throws InterruptedException if there is a problem running the command
	 */
	private boolean isServerRunning() throws IOException, InterruptedException {
		File createCommand = new File(postgresRoot, "bin/pg_isready");
		List<String> command = new ArrayList<String>();
		command.add(createCommand.getAbsolutePath());
		if ((port != -1) && (port != 5432)) {	// Non-default port
			command.add("-p");

View on GitHub (pinned to d5f144c24d)

Solutions

1. Add a CN= component to the DN, e.g. "CN=bsim-server,O=Acme".
2. Ensure CN appears at least once; the parser takes the first CN found.
3. Keep attribute syntax RFC 2253 compliant (key=value, comma-separated).

Example fix

// before
bsim control configure host --auth pki --dn "O=Acme,OU=Eng"
// after
bsim control configure host --auth pki --dn "CN=bsim-server,O=Acme,OU=Eng"

// Require a CN= component in the DN before passing it to the tool.
boolean hasCn = false;
for (String part : dn.split(",")) {
    String kv[] = part.split("=", 2);
    if (kv.length == 2 && kv[0].trim().equalsIgnoreCase("CN") && !kv[1].trim().isEmpty()) {
        hasCn = true;
        break;
    }
}
if (!hasCn) {
    System.err.println("DN must contain a CN= component: " + dn);
    return;
}

try {
    launchable.validateDistinguishedName();
} catch (IllegalArgumentException e) {
    if (e.getMessage().equals("Missing common name attribute")) {
        System.err.println("Add CN=<name> to the distinguished name.");
    }
    throw e;
}

When it happens

Trigger: Passing a DN with no CN= component, e.g. `--dn "O=Acme,OU=Eng"`. The loop finds no RDN whose type equals 'CN' (case-insensitive) and throws at line 425.

Common situations: Using an org/OU-only DN, forgetting the CN, or copying a DN format from a system that does not require CN.

Related errors

• Improperly formatted distinguished name
• Failed to generate BSim server certificate
• File {} does not appear to be a certificate
• Path to certificate necessary to start server (--cert /path/
• %s: unknown demangling style `%s'

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/f48f596709111b72. Report an issue: GitHub.