{"record":{"id":"9208b8dc2e8c8e31","repo":"cert-manager/cert-manager","slug":"certificate-request-contains-no-common-name-dns-n","errorCode":null,"errorMessage":"certificate request contains no Common Name, DNS Name, nor URI SAN, at least one must be supplied to be used as the certificate objects name","messagePattern":"certificate request contains no Common Name, DNS Name, nor URI SAN, at least one must be supplied to be used as the certificate objects name","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/issuer/venafi/client/request.go","lineNumber":220,"sourceCode":"\treturn req\n}\n\nfunc getVcertFriendlyName(crt *x509.Certificate) (string, error) {\n\t// Set the 'ObjectName' through the vcert friendly name. This is set in\n\t// order of precedence CN->DNS->URI.\n\tswitch {\n\tcase len(crt.Subject.CommonName) > 0:\n\t\treturn crt.Subject.CommonName, nil\n\tcase len(crt.DNSNames) > 0:\n\t\treturn crt.DNSNames[0], nil\n\tcase len(crt.URIs) > 0:\n\t\treturn crt.URIs[0].String(), nil\n\tcase len(crt.EmailAddresses) > 0:\n\t\treturn crt.EmailAddresses[0], nil\n\tcase len(crt.IPAddresses) > 0:\n\t\treturn crt.IPAddresses[0].String(), nil\n\tdefault:\n\t\treturn \"\", errors.New(\"certificate request contains no Common Name, DNS Name, nor URI SAN, at least one must be supplied to be used as the certificate objects name\")\n\t}\n}\n","sourceCodeStart":202,"sourceCodeEnd":223,"githubUrl":"https://github.com/cert-manager/cert-manager/blob/79dd67caae8e6ea319ac9cf7f0a380b77c3a9f2b/pkg/issuer/venafi/client/request.go#L202-L223","documentation":"getVcertFriendlyName derives the object name Venafi will use for the certificate, preferring CommonName, then DNS names, URI SANs, email addresses, and IP addresses. If the parsed certificate has none of these, it errors because a friendly name cannot be constructed. buildVReq calls it while assembling the Venafi request.","triggerScenarios":"Calling RequestCertificate with a CSR whose parsed x509.Certificate has no CommonName, no DNSNames, no URIs, no EmailAddresses, and no IPAddresses — e.g. only Organization/OU subject fields plus no SANs.","commonSituations":"CSRs generated with only a subject and no SAN extension; misconfigured Certificate resources with empty commonName and empty dnsNames; CSR parsing dropping SANs due to malformed extensions.","solutions":["Add at least one of: commonName, a DNS name, or a URI SAN to the certificate request.","Set spec.dnsNames (and/or ipAddresses, emailAddresses) on the Certificate resource.","Inspect the CSR with `openssl req -text` to confirm SAN extensions and CN are present.","If using ipAddresses/emails only for identity, note Venafi naming prefers CN/DNS/URI — add a CN to get a stable friendly name."],"exampleFix":"// before\nspec:\n  organization: [\"Example Corp\"]\n// after\nspec:\n  commonName: svc.example.com\n  organization: [\"Example Corp\"]\n  dnsNames: [\"svc.example.com\"]","handlingStrategy":"validation","validationCode":"if len(csr.DNSNames) == 0 && csr.Subject.CommonName == \"\" && len(csr.URIs) == 0 &&\n    len(csr.IPAddresses) == 0 && len(csr.EmailAddresses) == 0 {\n    return errors.New(\"CSR must contain CN or at least one DNS/URI/IP/email SAN\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"no Common Name, DNS Name, nor URI SAN\") {\n    // surface guidance to add commonName or dnsNames\n}","preventionTips":["Require dnsNames or commonName in every Certificate spec","Reject empty-SAN CSRs at admission time","Verify SAN presence with `openssl req -text -noout`"],"tags":["venafi","csr","san","validation"],"backgroundTag":"missing-required-argument","analyzedSha":"79dd67caae8e6ea319ac9cf7f0a380b77c3a9f2b","analyzedAt":"2026-09-07T11:40:01.968Z","contentChangedAt":"2026-09-07T11:40:01.968Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}