{"record":{"id":"6ff7c9621de2e687","repo":"oven-sh/bun","slug":"excluded-violation","errorCode":"EXCLUDED_VIOLATION","errorMessage":"EXCLUDED_VIOLATION","messagePattern":"EXCLUDED_VIOLATION","errorType":"error_code","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":217,"sourceCode":"    #[error(\"KEYUSAGE_NO_DIGITAL_SIGNATURE\")]\n    KEYUSAGE_NO_DIGITAL_SIGNATURE,\n    #[error(\"PROXY_CERTIFICATES_NOT_ALLOWED\")]\n    PROXY_CERTIFICATES_NOT_ALLOWED,\n    #[error(\"INVALID_EXTENSION\")]\n    INVALID_EXTENSION,\n    #[error(\"INVALID_POLICY_EXTENSION\")]\n    INVALID_POLICY_EXTENSION,\n    #[error(\"NO_EXPLICIT_POLICY\")]\n    NO_EXPLICIT_POLICY,\n    #[error(\"DIFFERENT_CRL_SCOPE\")]\n    DIFFERENT_CRL_SCOPE,\n    #[error(\"UNSUPPORTED_EXTENSION_FEATURE\")]\n    UNSUPPORTED_EXTENSION_FEATURE,\n    #[error(\"UNNESTED_RESOURCE\")]\n    UNNESTED_RESOURCE,\n    #[error(\"PERMITTED_VIOLATION\")]\n    PERMITTED_VIOLATION,\n    #[error(\"EXCLUDED_VIOLATION\")]\n    EXCLUDED_VIOLATION,\n    #[error(\"SUBTREE_MINMAX\")]\n    SUBTREE_MINMAX,\n    #[error(\"APPLICATION_VERIFICATION\")]\n    APPLICATION_VERIFICATION,\n    #[error(\"UNSUPPORTED_CONSTRAINT_TYPE\")]\n    UNSUPPORTED_CONSTRAINT_TYPE,\n    #[error(\"UNSUPPORTED_CONSTRAINT_SYNTAX\")]\n    UNSUPPORTED_CONSTRAINT_SYNTAX,\n    #[error(\"UNSUPPORTED_NAME_SYNTAX\")]\n    UNSUPPORTED_NAME_SYNTAX,\n    #[error(\"CRL_PATH_VALIDATION_ERROR\")]\n    CRL_PATH_VALIDATION_ERROR,\n    #[error(\"SUITE_B_INVALID_VERSION\")]\n    SUITE_B_INVALID_VERSION,\n    #[error(\"SUITE_B_INVALID_ALGORITHM\")]\n    SUITE_B_INVALID_ALGORITHM,\n    #[error(\"SUITE_B_INVALID_CURVE\")]","sourceCodeStart":199,"sourceCodeEnd":235,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L199-L235","documentation":"CertError::EXCLUDED_VIOLATION maps BoringSSL X509_V_ERR_EXCLUDED_VIOLATION (verify code 48). A CA's nameConstraints excludedSubtrees explicitly forbids a name space, and the certificate being validated contains a SAN/subject inside an excluded subtree. Message: \"excluded subtree violation\".","triggerScenarios":"CA declares excludedSubtrees = DNS:legacy.example.com (or IP:10.0.0.0/8, email:@internal), and a leaf was issued containing exactly such a name. Exclusions override permitted subtrees.","commonSituations":"Orgs that excluded retired/deprecated domains from a CA, then a cert is minted for one of them; security teams excluding internal ranges from externally-issued certs; CA operators using exclusions to carve out exceptions that later collide with new issuance requests.","solutions":["Read the exclusions: openssl x509 -in ca.pem -noout -text (Name Constraints, excluded subtrees)","Move the service to a name outside the excluded subtree and reissue the SAN","If the exclusion is obsolete, reissue the CA without that excludedSubtree (and re-key the chain)","Confirm no other name in the cert (subject CN, email, URI, IP SANs) also lands in an exclusion"],"exampleFix":"# before: CA excludes DNS:legacy.example.com ; leaf SAN collides\nsubjectAltName = DNS:app.legacy.example.com\n\n# after: serve under a non-excluded name\nsubjectAltName = DNS:app.example.com","handlingStrategy":"validation","validationCode":"// Check requested SANs against the CA's exclusion list before issuance\nexport function sansAvoidExclusions(sans /* string[] */, excluded /* e.g. [\"legacy.example.com\", \"10.0.0.0/8\"] */) {\n  const inSubnet = (ip, cidr) => { /* CIDR containment check */ return true; };\n  return sans.every((san) => !excluded.some((ex) =>\n    ex.includes(\"/\") ? inSubnet(san, ex)\n    : san === ex || san.endsWith(\".\" + ex)\n  ));\n}","typeGuard":"export function isExcludedViolation(e): e is Error & { code: \"EXCLUDED_VIOLATION\" } {\n  return e instanceof Error && (e as any).code === \"EXCLUDED_VIOLATION\";\n}","tryCatchPattern":"try {\n  await fetch(url);\n} catch (e) {\n  if (e?.code === \"EXCLUDED_VIOLATION\") {\n    // name is explicitly excluded by a CA's nameConstraints - pick another name or drop the exclusion\n    relabelService(new URL(url).hostname);\n  } else throw e;\n}","preventionTips":["Keep the CA's excluded-subtree list next to your service-name registry and check both when naming services","Retire exclusions deliberately: removing one requires CA reissue, plan it","Watch for IP-range exclusions silently blocking IP-SAN-only endpoints"],"tags":["tls","x509","name-constraints","san","pki","fetch","security"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}