{"record":{"id":"9bbe53090042f764","repo":"oven-sh/bun","slug":"no-explicit-policy","errorCode":"NO_EXPLICIT_POLICY","errorMessage":"NO_EXPLICIT_POLICY","messagePattern":"NO_EXPLICIT_POLICY","errorType":"error_code","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":207,"sourceCode":"    #[error(\"UNHANDLED_CRITICAL_EXTENSION\")]\n    UNHANDLED_CRITICAL_EXTENSION,\n    #[error(\"KEYUSAGE_NO_CRL_SIGN\")]\n    KEYUSAGE_NO_CRL_SIGN,\n    #[error(\"UNHANDLED_CRITICAL_CRL_EXTENSION\")]\n    UNHANDLED_CRITICAL_CRL_EXTENSION,\n    #[error(\"INVALID_NON_CA\")]\n    INVALID_NON_CA,\n    #[error(\"PROXY_PATH_LENGTH_EXCEEDED\")]\n    PROXY_PATH_LENGTH_EXCEEDED,\n    #[error(\"KEYUSAGE_NO_DIGITAL_SIGNATURE\")]\n    KEYUSAGE_NO_DIGITAL_SIGNATURE,\n    #[error(\"PROXY_CERTIFICATES_NOT_ALLOWED\")]\n    PROXY_CERTIFICATES_NOT_ALLOWED,\n    #[error(\"INVALID_EXTENSION\")]\n    INVALID_EXTENSION,\n    #[error(\"INVALID_POLICY_EXTENSION\")]\n    INVALID_POLICY_EXTENSION,\n    #[error(\"NO_EXPLICIT_POLICY\")]\n    NO_EXPLICIT_POLICY,\n    #[error(\"DIFFERENT_CRL_SCOPE\")]\n    DIFFERENT_CRL_SCOPE,\n    #[error(\"UNSUPPORTED_EXTENSION_FEATURE\")]\n    UNSUPPORTED_EXTENSION_FEATURE,\n    #[error(\"UNNESTED_RESOURCE\")]\n    UNNESTED_RESOURCE,\n    #[error(\"PERMITTED_VIOLATION\")]\n    PERMITTED_VIOLATION,\n    #[error(\"EXCLUDED_VIOLATION\")]\n    EXCLUDED_VIOLATION,\n    #[error(\"SUBTREE_MINMAX\")]\n    SUBTREE_MINMAX,\n    #[error(\"APPLICATION_VERIFICATION\")]\n    APPLICATION_VERIFICATION,\n    #[error(\"UNSUPPORTED_CONSTRAINT_TYPE\")]\n    UNSUPPORTED_CONSTRAINT_TYPE,\n    #[error(\"UNSUPPORTED_CONSTRAINT_SYNTAX\")]","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L189-L225","documentation":"CertError::NO_EXPLICIT_POLICY maps BoringSSL X509_V_ERR_NO_EXPLICIT_POLICY (verify code 43). RFC 5280 policy processing ended with no explicit certificate policy while the verification context requires one (explicit-policy indicator set on the trust anchor / verify params). Bun surfaces it as code \"NO_EXPLICIT_POLICY\", message \"no explicit policy\".","triggerScenarios":"Path validation runs with policy checking and requireExplicitPolicy: every cert in the chain must then carry an acceptable certificatePolicies entry. A chain where the leaf omits certificatePolicies (or contains none of the user-initial-policy OIDs) fails with this code.","commonSituations":"Private/government PKIs where the root mandates a specific policy OID but leafs were issued from a template without it; verification stacks upgraded to enforce policy processing (behavior change after an OpenSSL/BoringSSL update); chains mixing public CA leafs with a constrained enterprise anchor.","solutions":["Reissue the leaf/intermediates with the required policy OID in certificatePolicies (e.g. 2.23.140.1.2.1 for DV)","On the verifying side, drop the explicit-policy requirement (remove X509_V_FLAG_POLICY_CHECK / initial-explicit-policy) if policy matching is not actually mandated","Check that the trust anchor is the intended one - pointing at a policy-constrained root for a public endpoint causes exactly this","Confirm with openssl verify -policy <oid> -CAfile ca.pem leaf.pem which cert in the chain lacks the policy"],"exampleFix":"# before: leaf template without policies (fails when anchor requires explicit policy)\n[v3]\nbasicConstraints = critical, CA:FALSE\nsubjectAltName = DNS:example.com\n\n# after: include the required policy\n[v3]\nbasicConstraints = critical, CA:FALSE\nsubjectAltName = DNS:example.com\ncertificatePolicies = 1.2.3.4.5, 2.23.140.1.2.1","handlingStrategy":"try-catch","validationCode":"// Verify the chain satisfies the required policy OID before the real request\nimport { execFileSync } from \"node:child_process\";\nexport function chainHasPolicy(certPem, caPem, oid) {\n  execFileSync(\"openssl\", [\"verify\", \"-policy\", oid, \"-CAfile\", caPem, \"-untrusted\", certPem, certPem], { stdio: \"pipe\" });\n  return true; // throws if no acceptable policy\n}","typeGuard":"export function isNoExplicitPolicy(e): e is Error & { code: \"NO_EXPLICIT_POLICY\" } {\n  return e instanceof Error && (e as any).code === \"NO_EXPLICIT_POLICY\";\n}","tryCatchPattern":"try {\n  await fetch(url);\n} catch (e) {\n  if (e?.code === \"NO_EXPLICIT_POLICY\") {\n    // chain lacks a policy the trust anchor demands - add certificatePolicies or relax the requirement\n    routeToPkiTeam(url);\n  } else throw e;\n}","preventionTips":["Document which policy OIDs each trust anchor requires and encode them in issuance templates","When adding a new anchor, re-verify every relying endpoint with openssl verify -policy","Treat policy requirements as part of the CA contract - version them like code"],"tags":["tls","x509","certificate-policies","pki","fetch","security"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}