{"record":{"id":"7dc336ddefc08499","repo":"v2rayA/v2rayA","slug":"bad-certificate-no-names-found","errorCode":null,"errorMessage":"bad certificate: no names found","messagePattern":"bad certificate: no names found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"service/common/crypto.go","lineNumber":141,"sourceCode":"func GetCertInfo(crt string) (names []string, err error) {\n\tb, err := os.ReadFile(crt)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tp, _ := pem.Decode(b)\n\tif p == nil {\n\t\treturn nil, fmt.Errorf(\"bad certificate\")\n\t}\n\tcert, err := x509.ParseCertificate(p.Bytes)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"bad certificate: %w\", err)\n\t}\n\tnames = append(names, cert.DNSNames...)\n\tfor _, ip := range cert.IPAddresses {\n\t\tnames = append(names, ip.String())\n\t}\n\tif len(names) <= 0 {\n\t\treturn nil, fmt.Errorf(\"bad certificate: no names found\")\n\t}\n\treturn names, nil\n}\n","sourceCodeStart":123,"sourceCodeEnd":145,"githubUrl":"https://github.com/v2rayA/v2rayA/blob/71e5442fc548c05680ee55eae943e6c0afe9ac51/service/common/crypto.go#L123-L145","documentation":"GetCertInfo collects SAN entries from the parsed certificate: DNSNames plus IPAddresses. If a certificate has neither any DNS SAN nor any IP SAN, the function refuses to proceed and returns \"bad certificate: no names found\". Certificates with only Common Name (no SAN) are rejected.","triggerScenarios":"Calling GetCertInfo on a certificate whose SAN extension contains no dNSName and no iPAddress entries (names list empty after appending DNSNames and IP addresses).","commonSituations":"Old/self-signed certificates that only set CN without a SAN extension; hand-rolled certificates generated without -extfile SAN entries; internal CA certificates missing SANs.","solutions":["Regenerate the certificate including SAN entries (openssl req -addext \"subjectAltName=DNS:example.com\")","If the cert relies on CN only, re-issue it with SANs — modern TLS clients ignore CN","Confirm the intended cert was fetched, not a placeholder/CA cert"],"exampleFix":"// before\nopenssl req -x509 -newkey rsa:2048 -keyout k.pem -out c.pem -subj \"/CN=myhost\"\n// after\nopenssl req -x509 -newkey rsa:2048 -keyout k.pem -out c.pem -subj \"/CN=myhost\" -addext \"subjectAltName=DNS:myhost,IP:127.0.0.1\"","handlingStrategy":"validation","validationCode":"block, _ := pem.Decode(raw)\nif block != nil {\n    if c, err := x509.ParseCertificate(block.Bytes); err == nil {\n        if len(c.DNSNames) == 0 && len(c.IPAddresses) == 0 {\n            return fmt.Errorf(\"certificate has no SAN entries\")\n        }\n    }\n}","typeGuard":"func certHasSANs(raw []byte) bool {\n    p, _ := pem.Decode(raw)\n    if p == nil { return false }\n    c, err := x509.ParseCertificate(p.Bytes)\n    return err == nil && (len(c.DNSNames) > 0 || len(c.IPAddresses) > 0)\n}","tryCatchPattern":"if err != nil {\n    if strings.Contains(err.Error(), \"no names found\") {\n        // re-issue cert with SANs\n    }\n    return err\n}","preventionTips":["Always include subjectAltName when issuing certificates","Never rely on CN-only certificates for modern TLS","Validate issued certs with openssl x509 -text to confirm SANs"],"tags":["tls","certificate","san"],"backgroundTag":"certificate-missing-san","analyzedSha":"71e5442fc548c05680ee55eae943e6c0afe9ac51","analyzedAt":"2026-09-05T20:04:37.459Z","contentChangedAt":"2026-09-05T20:04:37.459Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}