{"record":{"id":"95cd034977616bce","repo":"oven-sh/bun","slug":"unsupported-name-syntax","errorCode":"UNSUPPORTED_NAME_SYNTAX","errorMessage":"UNSUPPORTED_NAME_SYNTAX","messagePattern":"UNSUPPORTED_NAME_SYNTAX","errorType":"error_code","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":227,"sourceCode":"    #[error(\"DIFFERENT_CRL_SCOPE\")]\n    DIFFERENT_CRL_SCOPE,\n    #[error(\"UNSUPPORTED_EXTENSION_FEATURE\")]\n    UNSUPPORTED_EXTENSION_FEATURE,\n    #[error(\"UNNESTED_RESOURCE\")]\n    UNNESTED_RESOURCE,\n    #[error(\"PERMITTED_VIOLATION\")]\n    PERMITTED_VIOLATION,\n    #[error(\"EXCLUDED_VIOLATION\")]\n    EXCLUDED_VIOLATION,\n    #[error(\"SUBTREE_MINMAX\")]\n    SUBTREE_MINMAX,\n    #[error(\"APPLICATION_VERIFICATION\")]\n    APPLICATION_VERIFICATION,\n    #[error(\"UNSUPPORTED_CONSTRAINT_TYPE\")]\n    UNSUPPORTED_CONSTRAINT_TYPE,\n    #[error(\"UNSUPPORTED_CONSTRAINT_SYNTAX\")]\n    UNSUPPORTED_CONSTRAINT_SYNTAX,\n    #[error(\"UNSUPPORTED_NAME_SYNTAX\")]\n    UNSUPPORTED_NAME_SYNTAX,\n    #[error(\"CRL_PATH_VALIDATION_ERROR\")]\n    CRL_PATH_VALIDATION_ERROR,\n    #[error(\"SUITE_B_INVALID_VERSION\")]\n    SUITE_B_INVALID_VERSION,\n    #[error(\"SUITE_B_INVALID_ALGORITHM\")]\n    SUITE_B_INVALID_ALGORITHM,\n    #[error(\"SUITE_B_INVALID_CURVE\")]\n    SUITE_B_INVALID_CURVE,\n    #[error(\"SUITE_B_INVALID_SIGNATURE_ALGORITHM\")]\n    SUITE_B_INVALID_SIGNATURE_ALGORITHM,\n    #[error(\"SUITE_B_LOS_NOT_ALLOWED\")]\n    SUITE_B_LOS_NOT_ALLOWED,\n    #[error(\"SUITE_B_CANNOT_SIGN_P_384_WITH_P_256\")]\n    SUITE_B_CANNOT_SIGN_P_384_WITH_P_256,\n    #[error(\"HOSTNAME_MISMATCH\")]\n    HOSTNAME_MISMATCH,\n    #[error(\"EMAIL_MISMATCH\")]","sourceCodeStart":209,"sourceCodeEnd":245,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L209-L245","documentation":"CertError::UNSUPPORTED_NAME_SYNTAX maps BoringSSL X509_V_ERR_UNSUPPORTED_NAME_SYNTAX (verify code 53). A name inside the certificate (SAN entry, subject DN, or a name being matched) has invalid or unsupported syntax for its GeneralName type - e.g. a directoryName whose DN violates encoding rules, a URI SAN that is not a valid URI, or an email SAN with bad syntax. Message: \"unsupported or invalid name syntax\".","triggerScenarios":"Chain validation reaches a name it must process (because constraints apply or it is the reference name) and its syntax fails the per-type parser; common with malformed directoryName SANs and malformed URI/email SANs.","commonSituations":"Certificates minted by scripts with unescaped special characters in DNs; SANs like 'DNS:example.com ' (trailing whitespace) or URI entries without a scheme; certs accepted by lax verifiers then rejected when path processing actually reads the name.","solutions":["Inspect all names: openssl x509 -in cert.pem -noout -text (Subject Alternative Name + Subject)","Reissue with clean values: no whitespace in DNS SANs, scheme-present URIs, properly escaped DN components (commas as \\,)","Check the issuer's nameConstraints too - the rejected name may be in the CA, not the leaf"],"exampleFix":"# before: bad SAN syntax\nsubjectAltName = DNS:\"example.com \", URI:example.com/resource\n\n# after: valid syntax\nsubjectAltName = DNS:example.com, URI:https://example.com/resource","handlingStrategy":"validation","validationCode":"// Lint SAN entries and subject DN syntax before the cert is trusted/issued\nexport function namesSyntaxOk(sans /* {type,value}[] */) {\n  return sans.every(({ type, value }) => {\n    const v = value.trim();\n    if (v !== value) return false;                 // no surrounding whitespace\n    if (type === \"DNS\") return /^[a-z0-9*.-]+$/i.test(v);\n    if (type === \"URI\") return /^[a-z][a-z0-9+.-]*:/.test(v); // has a scheme\n    if (type === \"IP\") return /^[\\d.:a-f]+$/i.test(v);\n    return true;\n  });\n}","typeGuard":"export function isUnsupportedNameSyntax(e): e is Error & { code: \"UNSUPPORTED_NAME_SYNTAX\" } {\n  return e instanceof Error && (e as any).code === \"UNSUPPORTED_NAME_SYNTAX\";\n}","tryCatchPattern":"try {\n  await fetch(url);\n} catch (e) {\n  if (e?.code === \"UNSUPPORTED_NAME_SYNTAX\") {\n    // some SAN/DN in the chain has invalid syntax for its type - reissue cleanly\n    requestCertReroll(new URL(url).hostname);\n  } else throw e;\n}","preventionTips":["Trim and regex-check SAN values in CSR intake - whitespace and missing URI schemes are the classic breakage","Escape DN special characters (, + =) when generating subjects programmatically","Lint the CA's names too; the invalid name may live upstream of the leaf"],"tags":["tls","x509","san","asn1","rfc5280","fetch","security"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}