{"record":{"id":"44e0dca4d67fe09b","repo":"oven-sh/bun","slug":"keyusage-no-certsign","errorCode":"KEYUSAGE_NO_CERTSIGN","errorMessage":"KEYUSAGE_NO_CERTSIGN","messagePattern":"KEYUSAGE_NO_CERTSIGN","errorType":"error_code","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":185,"sourceCode":"    #[error(\"CERT_REVOKED\")]\n    CERT_REVOKED,\n    #[error(\"INVALID_CA\")]\n    INVALID_CA,\n    #[error(\"PATH_LENGTH_EXCEEDED\")]\n    PATH_LENGTH_EXCEEDED,\n    #[error(\"INVALID_PURPOSE\")]\n    INVALID_PURPOSE,\n    #[error(\"CERT_UNTRUSTED\")]\n    CERT_UNTRUSTED,\n    #[error(\"CERT_REJECTED\")]\n    CERT_REJECTED,\n    #[error(\"SUBJECT_ISSUER_MISMATCH\")]\n    SUBJECT_ISSUER_MISMATCH,\n    #[error(\"AKID_SKID_MISMATCH\")]\n    AKID_SKID_MISMATCH,\n    #[error(\"AKID_ISSUER_SERIAL_MISMATCH\")]\n    AKID_ISSUER_SERIAL_MISMATCH,\n    #[error(\"KEYUSAGE_NO_CERTSIGN\")]\n    KEYUSAGE_NO_CERTSIGN,\n    #[error(\"UNABLE_TO_GET_CRL_ISSUER\")]\n    UNABLE_TO_GET_CRL_ISSUER,\n    #[error(\"UNHANDLED_CRITICAL_EXTENSION\")]\n    UNHANDLED_CRITICAL_EXTENSION,\n    #[error(\"KEYUSAGE_NO_CRL_SIGN\")]\n    KEYUSAGE_NO_CRL_SIGN,\n    #[error(\"UNHANDLED_CRITICAL_CRL_EXTENSION\")]\n    UNHANDLED_CRITICAL_CRL_EXTENSION,\n    #[error(\"INVALID_NON_CA\")]\n    INVALID_NON_CA,\n    #[error(\"PROXY_PATH_LENGTH_EXCEEDED\")]\n    PROXY_PATH_LENGTH_EXCEEDED,\n    #[error(\"KEYUSAGE_NO_DIGITAL_SIGNATURE\")]\n    KEYUSAGE_NO_DIGITAL_SIGNATURE,\n    #[error(\"PROXY_CERTIFICATES_NOT_ALLOWED\")]\n    PROXY_CERTIFICATES_NOT_ALLOWED,\n    #[error(\"INVALID_EXTENSION\")]","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L167-L203","documentation":"CertError::KEYUSAGE_NO_CERTSIGN maps BoringSSL X509 verify code 32 (X509_V_ERR_KEYUSAGE_NO_CERTSIGN) via get_cert_error_from_no() in src/http/lib.rs:1551. A certificate acting as an issuer in the chain has a keyUsage extension that lacks the keyCertSign bit, so it is not allowed to sign certificates. JS error.code is KEYUSAGE_NO_CERTSIGN with message 'key usage does not include certificate signing' (FetchTasklet.rs:1478).","triggerScenarios":"Self-signed cert minted with keyUsage=digitalSignature (or default restrictive usage) then used to sign another cert; intermediate template missing keyCertSign; leaf certs used as ad-hoc CAs in test harnesses.","commonSituations":"Local dev scripts generating a 'CA' with openssl req -x509 and a restrictive -addext keyUsage, PKI templates cloned from server-cert profiles, mkcert-style workflows reimplemented incorrectly.","solutions":["Inspect the issuer's keyUsage: openssl x509 -in ca.pem -noout -text | grep -A1 'Key Usage' — must include Certificate Sign","Regenerate the CA with keyUsage=critical,keyCertSign,cRLSign and reissue everything beneath it","Never sign certs with a leaf; provision a real CA cert for issuing","Re-verify: openssl verify -CAfile new-ca.pem leaf.pem"],"exampleFix":"# before: CA without keyCertSign\nopenssl req -x509 -newkey rsa:2048 -keyout k.pem -out ca.pem \\\n  -addext 'keyUsage=digitalSignature'\n# after\nopenssl req -x509 -newkey rsa:2048 -keyout k.pem -out ca.pem -days 3650 \\\n  -addext 'keyUsage=critical,keyCertSign,cRLSign' \\\n  -addext 'basicConstraints=critical,CA:TRUE'","handlingStrategy":"validation","validationCode":"import { X509Certificate } from \"node:crypto\";\nconst ca = new X509Certificate(await Bun.file(\"ca.pem\").text());\nconst text = await Bun.$`openssl x509 -in ca.pem -noout -text`.text();\nif (!/Certificate Sign/.test(text)) {\n  throw new Error(\"issuing cert lacks keyCertSign — it must not sign certificates\");\n}","typeGuard":"function isNoCertSign(e: unknown): e is Error & { code: \"KEYUSAGE_NO_CERTSIGN\" } {\n  return e instanceof Error && (e as any).code === \"KEYUSAGE_NO_CERTSIGN\";\n}","tryCatchPattern":"try { await fetch(url); } catch (e) { if (isNoCertSign(e)) { alertPkiTeam(\"issuer missing keyCertSign on chain for \" + new URL(url).host); throw e; } throw e; }","preventionTips":["CA generation script must set keyUsage=critical,keyCertSign,cRLSign","Assert 'Certificate Sign' appears in issuer keyUsage during issuance","Never sign leafs with leafs; provision dedicated CA certs"],"tags":["tls","certificate","keyusage","ca","pki"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}