{"record":{"id":"670aff9f1d7a9f69","repo":"oven-sh/bun","slug":"suite-b-invalid-version","errorCode":"SUITE_B_INVALID_VERSION","errorMessage":"SUITE_B_INVALID_VERSION","messagePattern":"SUITE_B_INVALID_VERSION","errorType":"error_code","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":231,"sourceCode":"    #[error(\"UNNESTED_RESOURCE\")]\n    UNNESTED_RESOURCE,\n    #[error(\"PERMITTED_VIOLATION\")]\n    PERMITTED_VIOLATION,\n    #[error(\"EXCLUDED_VIOLATION\")]\n    EXCLUDED_VIOLATION,\n    #[error(\"SUBTREE_MINMAX\")]\n    SUBTREE_MINMAX,\n    #[error(\"APPLICATION_VERIFICATION\")]\n    APPLICATION_VERIFICATION,\n    #[error(\"UNSUPPORTED_CONSTRAINT_TYPE\")]\n    UNSUPPORTED_CONSTRAINT_TYPE,\n    #[error(\"UNSUPPORTED_CONSTRAINT_SYNTAX\")]\n    UNSUPPORTED_CONSTRAINT_SYNTAX,\n    #[error(\"UNSUPPORTED_NAME_SYNTAX\")]\n    UNSUPPORTED_NAME_SYNTAX,\n    #[error(\"CRL_PATH_VALIDATION_ERROR\")]\n    CRL_PATH_VALIDATION_ERROR,\n    #[error(\"SUITE_B_INVALID_VERSION\")]\n    SUITE_B_INVALID_VERSION,\n    #[error(\"SUITE_B_INVALID_ALGORITHM\")]\n    SUITE_B_INVALID_ALGORITHM,\n    #[error(\"SUITE_B_INVALID_CURVE\")]\n    SUITE_B_INVALID_CURVE,\n    #[error(\"SUITE_B_INVALID_SIGNATURE_ALGORITHM\")]\n    SUITE_B_INVALID_SIGNATURE_ALGORITHM,\n    #[error(\"SUITE_B_LOS_NOT_ALLOWED\")]\n    SUITE_B_LOS_NOT_ALLOWED,\n    #[error(\"SUITE_B_CANNOT_SIGN_P_384_WITH_P_256\")]\n    SUITE_B_CANNOT_SIGN_P_384_WITH_P_256,\n    #[error(\"HOSTNAME_MISMATCH\")]\n    HOSTNAME_MISMATCH,\n    #[error(\"EMAIL_MISMATCH\")]\n    EMAIL_MISMATCH,\n    #[error(\"IP_ADDRESS_MISMATCH\")]\n    IP_ADDRESS_MISMATCH,\n    #[error(\"INVALID_CALL\")]","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L213-L249","documentation":"CertError::SUITE_B_INVALID_VERSION maps BoringSSL X509_V_ERR_SUITE_B_INVALID_VERSION (verify code 56). NSA Suite B profile verification is enabled (X509_V_FLAG_SUITE_B_128_LOS / _192_LOS) and a certificate in the chain is not X.509 v3, which the Suite B profile mandates. Message: \"Suite B: certificate version invalid\".","triggerScenarios":"A verifier running with Suite B flags encounters a v1/v2 certificate in the chain (self-signed v1 roots are a classic source). Stock Bun never sets Suite B flags, so seeing this implies a custom verifying stack or a middlebox that does.","commonSituations":"Defense/compliance environments enabling Suite B on gateways; v1 root certificates grandfathered into trust stores years ago; TLS-terminating appliances with Suite B enabled in front of your service.","solutions":["Identify the non-v3 cert: openssl s_client -showcerts then openssl x509 -noout -text on each, checking 'Version: 1'","Replace the v1 root/intermediate with a v3 certificate","If Suite B compliance is not actually required, disable the Suite B flags on the verifying component","Confirm which hop enables Suite B (client config vs proxy) - the fix belongs there"],"exampleFix":"# before: v1 root\nopenssl req -x509 -newkey rsa:2048 -days 3650 -nodes ...\n\n# after: explicitly v3 with extensions\nopenssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -days 3650 -nodes -addext 'basicConstraints=critical,CA:TRUE' ...","handlingStrategy":"try-catch","validationCode":"// If a Suite B verifier is in play, assert the whole chain is X.509 v3 first\nimport tls from \"node:tls\";\nimport { X509Certificate } from \"node:crypto\";\nexport function chainIsV3(host, port = 443) {\n  return new Promise((resolve, reject) => {\n    const s = tls.connect({ host, port, servername: host, rejectUnauthorized: false }, () => {\n      let c = s.getPeerCertificate(true), ok = true;\n      do { ok = ok && new X509Certificate(c.raw).toString().includes(\"Version: 3\"); } while (c.issuerCertificate && (c = c.issuerCertificate) && !Object.is(c, s.getPeerCertificate(true)));\n      s.end(); resolve(ok);\n    });\n    s.on(\"error\", reject);\n  });\n}","typeGuard":"export function isSuiteBInvalidVersion(e): e is Error & { code: \"SUITE_B_INVALID_VERSION\" } {\n  return e instanceof Error && (e as any).code === \"SUITE_B_INVALID_VERSION\";\n}","tryCatchPattern":"try {\n  await fetch(url);\n} catch (e) {\n  if (e?.code === \"SUITE_B_INVALID_VERSION\") {\n    // Suite B profile is on somewhere and a pre-v3 cert is in the chain - replace it with v3\n    escalateToSuiteBOwner(url);\n  } else throw e;\n}","preventionTips":["Replace legacy v1 roots with v3 certificates before enabling Suite B anywhere","Know which hop enforces Suite B - clients, gateways, and terminating proxies each need auditing","Check 'Version: 3' in cert linting for every chain element, not just the leaf"],"tags":["tls","x509","suite-b","compliance","pki","fetch","security"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}