{"record":{"id":"9153f05a44a13a04","repo":"oven-sh/bun","slug":"unsupported-constraint-type","errorCode":"UNSUPPORTED_CONSTRAINT_TYPE","errorMessage":"UNSUPPORTED_CONSTRAINT_TYPE","messagePattern":"UNSUPPORTED_CONSTRAINT_TYPE","errorType":"error_code","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":223,"sourceCode":"    #[error(\"INVALID_POLICY_EXTENSION\")]\n    INVALID_POLICY_EXTENSION,\n    #[error(\"NO_EXPLICIT_POLICY\")]\n    NO_EXPLICIT_POLICY,\n    #[error(\"DIFFERENT_CRL_SCOPE\")]\n    DIFFERENT_CRL_SCOPE,\n    #[error(\"UNSUPPORTED_EXTENSION_FEATURE\")]\n    UNSUPPORTED_EXTENSION_FEATURE,\n    #[error(\"UNNESTED_RESOURCE\")]\n    UNNESTED_RESOURCE,\n    #[error(\"PERMITTED_VIOLATION\")]\n    PERMITTED_VIOLATION,\n    #[error(\"EXCLUDED_VIOLATION\")]\n    EXCLUDED_VIOLATION,\n    #[error(\"SUBTREE_MINMAX\")]\n    SUBTREE_MINMAX,\n    #[error(\"APPLICATION_VERIFICATION\")]\n    APPLICATION_VERIFICATION,\n    #[error(\"UNSUPPORTED_CONSTRAINT_TYPE\")]\n    UNSUPPORTED_CONSTRAINT_TYPE,\n    #[error(\"UNSUPPORTED_CONSTRAINT_SYNTAX\")]\n    UNSUPPORTED_CONSTRAINT_SYNTAX,\n    #[error(\"UNSUPPORTED_NAME_SYNTAX\")]\n    UNSUPPORTED_NAME_SYNTAX,\n    #[error(\"CRL_PATH_VALIDATION_ERROR\")]\n    CRL_PATH_VALIDATION_ERROR,\n    #[error(\"SUITE_B_INVALID_VERSION\")]\n    SUITE_B_INVALID_VERSION,\n    #[error(\"SUITE_B_INVALID_ALGORITHM\")]\n    SUITE_B_INVALID_ALGORITHM,\n    #[error(\"SUITE_B_INVALID_CURVE\")]\n    SUITE_B_INVALID_CURVE,\n    #[error(\"SUITE_B_INVALID_SIGNATURE_ALGORITHM\")]\n    SUITE_B_INVALID_SIGNATURE_ALGORITHM,\n    #[error(\"SUITE_B_LOS_NOT_ALLOWED\")]\n    SUITE_B_LOS_NOT_ALLOWED,\n    #[error(\"SUITE_B_CANNOT_SIGN_P_384_WITH_P_256\")]","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L205-L241","documentation":"CertError::UNSUPPORTED_CONSTRAINT_TYPE maps BoringSSL X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE (verify code 51). A nameConstraints extension contains a GeneralSubtree whose base is a name type the verifier cannot constrain - x400Address, ediPartyName, or registeredID. Message: \"unsupported name constraint type\".","triggerScenarios":"A CA encodes nameConstraints over an exotic GeneralName type; BoringSSL's path validation refuses the whole constraint set rather than ignoring it.","commonSituations":"Legacy EDI/X.400-era PKIs; ASN.1 generation tools that happily emit every name type; constraints copied from standards examples into real CA configs.","solutions":["Inspect which type is used: openssl x509 -in ca.pem -noout -text (Name Constraints section)","Reissue the CA constraining only supported types - DNS, IP, email, URI, directoryName","Delete unused exotic constraints; keep the smallest constraint set that expresses the policy"],"exampleFix":"# before: constraint over an unsupported name type\nnameConstraints = permitted;registeredID:1.2.3.4\n\n# after: supported types only\nnameConstraints = permitted;DNS:example.com, excluded;IP:10.0.0.0/8","handlingStrategy":"try-catch","validationCode":"// Lint CA nameConstraints for unsupported GeneralName types before deployment\nimport { execFileSync } from \"node:child_process\";\nexport function constraintsUseSupportedTypes(caPem) {\n  const txt = execFileSync(\"openssl\", [\"x509\", \"-noout\", \"-text\"], { input: caPem }).toString();\n  const nc = txt.split(\"X509v3 Name Constraints:\")[1] ?? \"\";\n  return !/(X400|EDI Party|Registered ID|othername)/i.test(nc);\n}","typeGuard":"export function isUnsupportedConstraintType(e): e is Error & { code: \"UNSUPPORTED_CONSTRAINT_TYPE\" } {\n  return e instanceof Error && (e as any).code === \"UNSUPPORTED_CONSTRAINT_TYPE\";\n}","tryCatchPattern":"try {\n  await fetch(url);\n} catch (e) {\n  if (e?.code === \"UNSUPPORTED_CONSTRAINT_TYPE\") {\n    // CA constrains an exotic name type - reissue with DNS/IP/email/URI/dirName only\n    flagCaConfig(url, \"exotic-constraint-type\");\n  } else throw e;\n}","preventionTips":["Restrict nameConstraints in CA templates to DNS, IP, email, URI, dirName","Lint every CA cert for exotic GeneralName types at issuance time","Avoid copying X.400/EDI-era PKI examples into modern configs"],"tags":["tls","x509","name-constraints","asn1","pki","fetch","security"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}