{"record":{"id":"6b2acc54c6f85767","repo":"elastic/elasticsearch","slug":"s-is-not-a-supported-x509-field-for-trust-restr","errorCode":null,"errorMessage":"${s} is not a supported x509 field for trust restrictions. Recognised values are [${values}]","messagePattern":"(.+?) is not a supported x509 field for trust restrictions\\. Recognised values are \\[(.+?)\\]","errorType":"validation","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/X509Field.java","lineNumber":42,"sourceCode":"\n    X509Field(String configValue, boolean supportedForRestrictedTrust) {\n        this.configValue = configValue;\n        this.supportedForRestrictedTrust = supportedForRestrictedTrust;\n    }\n\n    @Override\n    public String toString() {\n        return configValue;\n    }\n\n    public static X509Field parseForRestrictedTrust(String s) {\n        return EnumSet.allOf(X509Field.class)\n            .stream()\n            .filter(v -> v.supportedForRestrictedTrust)\n            .filter(v -> v.configValue.equalsIgnoreCase(s))\n            .findFirst()\n            .orElseThrow(() -> {\n                throw new SslConfigException(\n                    s\n                        + \" is not a supported x509 field for trust restrictions. \"\n                        + \"Recognised values are [\"\n                        + EnumSet.allOf(X509Field.class).stream().map(e -> e.configValue).collect(Collectors.toSet())\n                        + \"]\"\n                );\n            });\n    }\n}\n","sourceCodeStart":24,"sourceCodeEnd":52,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/X509Field.java#L24-L52","documentation":"parseForRestrictedTrust accepts only X509Field enum values whose supportedForRestrictedTrust flag is true. Currently those are subjectAltName.otherName.commonName and subjectAltName.dnsName. The supplied string is matched case-insensitively against configValue; on miss it throws an SslConfigException that lists every configValue in the enum.","triggerScenarios":"Configuring restricted trust (delegated/restricted trust manager) with an X.509 field name that is not one of the two supported SAN-based configValues, or has a typo.","commonSituations":"Using legacy names like commonName, cn, dns, subject_cn that the enum does not recognise; mis-typing subjectAltName.dnsName (e.g. subjectAltNames.dnsName, subject_alt_name.dns_name); copy-pasting from older documentation that used a different field vocabulary.","solutions":["Use one of the two supported configValues: subjectAltName.otherName.commonName or subjectAltName.dnsName","Match the exact dotted spelling and case-insensitive casing shown in the error's recognised-values set","If you need a field not on the list, it is not supported for restricted trust - restructure the certificate to put the identity in a SAN instead"],"exampleFix":"// before\nrestrict_subject_alt_name: \"dns\"\n// after\nrestrict_subject_alt_name: \"subjectAltName.dnsName\"","handlingStrategy":"validation","validationCode":"private static final Set<String> SUPPORTED = Set.of(\n    \"subjectAltName.otherName.commonName\", \"subjectAltName.dnsName\");\nString v = raw == null ? null : raw.trim();\nif (v == null || !SUPPORTED.contains(v.toLowerCase(Locale.ROOT))) {\n    throw new IllegalArgumentException(\"Unsupported x509 field for restricted trust: \" + raw);\n}\nX509Field.parseForRestrictedTrust(v);","typeGuard":"static boolean isSupportedX509Field(String s) {\n    return s != null && Set.of(\"subjectAltName.otherName.commonName\", \"subjectAltName.dnsName\")\n        .contains(s.trim().toLowerCase(Locale.ROOT));\n}","tryCatchPattern":"try { X509Field.parseForRestrictedTrust(s); }\ncatch (SslConfigException e) { throw new ConfigException(e.getMessage(), e); }","preventionTips":["Treat the recognised-values set in the error as the source of truth","Use SAN-based certificate identities so restricted trust is available","Avoid legacy commonName-only certs"],"tags":["ssl","x509","config","security","trust-restrictions"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}