{"record":{"id":"421b541ffc127e41","repo":"thanos-io/thanos","slug":"could-not-get-commonname-field-from-client-cert","errorCode":null,"errorMessage":"could not get commonName field from client cert","messagePattern":"could not get commonName field from client cert","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/tenancy/tenancy.go","lineNumber":124,"sourceCode":"\tcert := r.TLS.PeerCertificates[0]\n\n\tswitch certTenantField {\n\n\tcase CertificateFieldOrganization:\n\t\tif len(cert.Subject.Organization) == 0 {\n\t\t\treturn \"\", errors.New(\"could not get organization field from client cert\")\n\t\t}\n\t\ttenant = cert.Subject.Organization[0]\n\n\tcase CertificateFieldOrganizationalUnit:\n\t\tif len(cert.Subject.OrganizationalUnit) == 0 {\n\t\t\treturn \"\", errors.New(\"could not get organizationalUnit field from client cert\")\n\t\t}\n\t\ttenant = cert.Subject.OrganizationalUnit[0]\n\n\tcase CertificateFieldCommonName:\n\t\tif cert.Subject.CommonName == \"\" {\n\t\t\treturn \"\", errors.New(\"could not get commonName field from client cert\")\n\t\t}\n\t\ttenant = cert.Subject.CommonName\n\n\tdefault:\n\t\treturn \"\", errors.New(\"tls client cert field requested is not supported\")\n\t}\n\n\treturn tenant, nil\n}\n\nfunc GetTenantFromGRPCMetadata(ctx context.Context) (string, bool) {\n\tmd, ok := metadata.FromIncomingContext(ctx)\n\tif !ok || len(md.Get(DefaultTenantHeader)) == 0 {\n\t\treturn DefaultTenant, false\n\t}\n\treturn md.Get(DefaultTenantHeader)[0], true\n}\n","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/tenancy/tenancy.go#L106-L142","documentation":"Thrown by getTenantFromCertificate when the Common Name (CN) is configured as the tenant source but the presented client certificate has an empty Subject.CommonName. The proxy cannot identify the tenant and rejects the request.","triggerScenarios":"GetTenantFromHTTP with certTenantField=CertificateFieldCommonName on a client cert whose Subject.CommonName is empty (modern CAs and tools increasingly omit CN by default).","commonSituations":"cert-manager Certificate resources without a commonName set (CN became optional in newer cert-manager); openssl req issued without a CN in -subj; server flag set to common-name while certs follow a SAN-only issuance policy.","solutions":["Reissue the client certificate with a CN set to the tenant name (-subj '/CN=my-tenant')","Or configure the server to use a populated field: --tenant-certificate-field=organization or organizationalUnit","For cert-manager, add spec.commonName to the Certificate resource","Verify with 'openssl x509 -noout -subject' that CN is present"],"exampleFix":"// before (cert-manager)\nspec: {}\n// after\nspec:\n  commonName: my-tenant","handlingStrategy":"validation","validationCode":"// Go, check issued cert\nif cert.Subject.CommonName == \"\" {\n    return errors.New(\"client cert must have CommonName set for tenancy\")\n}","typeGuard":"func certHasCommonName(cert *x509.Certificate) bool {\n    return cert != nil && cert.Subject.CommonName != \"\"\n}","tryCatchPattern":null,"preventionTips":["Set spec.commonName in cert-manager Certificates or CN in openssl -subj","Remember CN is optional in modern issuance; never rely on it implicitly","Add a post-issuance check that CN equals the tenant name"],"tags":["tls","tenancy","certificate","mtls"],"backgroundTag":"empty-required-field","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}