{"record":{"id":"9f72d476a8874730","repo":"gravitational/teleport","slug":"hexstring-not-supported-s","errorCode":null,"errorMessage":"hexstring not supported: %s","messagePattern":"hexstring not supported: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/utils/pkixname/parser.go","lineNumber":456,"sourceCode":"\t\t\t\tstate == tokenizeStateAttrTypeEnd ||\n\t\t\t\tstate == tokenizeStateStringStart ||\n\t\t\t\tstate == tokenizeStateStringQuoteEnd) {\n\t\t\tcontinue\n\t\t}\n\n\t\t// string start/end handling.\n\t\t// This happens early because we sometimes transition to \"string\" without\n\t\t// consuming the rune.\n\t\tswitch state {\n\t\tcase tokenizeStateStringStart:\n\t\t\tswitch r {\n\t\t\tcase '+', ',', ';':\n\t\t\t\t// Empty strings are valid.\n\t\t\t\temitBuffer(tokenString)\n\t\t\t\ttransitionToNameComponent(r)\n\t\t\t\tcontinue\n\t\t\tcase '#':\n\t\t\t\treturn nil, fmt.Errorf(\"hexstring not supported: %s\", errTrace(pos))\n\t\t\tcase '\"':\n\t\t\t\t// Note that a quoted string may be empty.\n\t\t\t\tstate = tokenizeStateStringQuote\n\t\t\t\tcontinue\n\t\t\tdefault:\n\t\t\t\tstate = tokenizeStateString\n\t\t\t\t// Rune not consumed.\n\t\t\t}\n\n\t\tcase tokenizeStateStringEnd:\n\t\t\tswitch r {\n\t\t\tcase ' ':\n\t\t\t\ttrailingSpaceBuf.WriteRune(r)\n\t\t\t\tcontinue\n\t\t\tcase '+', ',', ';':\n\t\t\t\ttrailingSpaceBuf.Reset() // whitespace discarded.\n\t\t\t\temitBuffer(tokenString)\n\t\t\t\ttransitionToNameComponent(r)","sourceCodeStart":438,"sourceCodeEnd":474,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/utils/pkixname/parser.go#L438-L474","documentation":"ParseDistinguishedName parses an RFC 2253-like DN but deliberately does not support hex-encoded values (\"#\" followed by hex bytes, e.g. \"#0402ABCD\"). When the tokenizer reaches the value position (tokenizeStateStringStart) and sees '#', it rejects the DN outright because the library only supports string attribute values.","triggerScenarios":"Calling pkixname.ParseDistinguishedName with any DN where an attribute value begins with '#', e.g. \"CN=#1302AB\" or \"OID.1.2.3=#041102\". The error is raised in tokenize at the exact position of the '#'.","commonSituations":"Copy-pasting DNs from OpenSSL output, LDAP directories, or certificate subjects that use hex-encoded (BER/DER) values, or DNs written with leading '#' to 'protect' values from tools interpreting them. Also common when migrating configs from libraries that accept hexstrings (e.g. Go's crypto/x509 or OpenLDAP).","solutions":["Replace the hex value with its plain string equivalent, e.g. \"CN=Example\" instead of \"CN=#13024578616D706C65\".","Use a known symbolic attribute type (C, O, OU, CN, ST, L, STREET, POSTALCODE, SERIALNUMBER) with a string value.","If a custom OID value is needed, express it as a string: \"1.2.3.4=myvalue\" (parsed into ExtraNames), not a hex blob.","Pre-validate the DN in caller code and reject/transform any '#'-prefixed values before calling ParseDistinguishedName."],"exampleFix":"// before\nname, err := pkixname.ParseDistinguishedName(\"CN=#13024578616D706C65\")\n// after\nname, err := pkixname.ParseDistinguishedName(\"CN=Example\")","handlingStrategy":"validation","validationCode":"func hasHexValue(dn string) bool {\n\tfor i := 0; i < len(dn); i++ {\n\t\tif dn[i] == '#' && (i == 0 || dn[i-1] == ',' || dn[i-1] == '+' || dn[i-1] == ' ' || dn[i-1] == '=') {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}\n// if hasHexValue(dn) { convert or reject before ParseDistinguishedName }","typeGuard":null,"tryCatchPattern":"name, err := pkixname.ParseDistinguishedName(dn)\nif err != nil {\n\tif strings.Contains(err.Error(), \"hexstring not supported\") {\n\t\t// fall back: convert hex value to string form or surface a clear config error\n\t\treturn nil, fmt.Errorf(\"DN %q uses unsupported hex values; use string values\", dn)\n\t}\n\treturn nil, err\n}","preventionTips":["Never write attribute values with a leading '#' in configs","Convert hex-encoded values to plain strings before storing DNs","Add a unit test for any DN template shipped in config"],"tags":["x509","distinguished-name","parser","unsupported-feature"],"backgroundTag":"dn-hexstring-not-supported","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}