{"record":{"id":"b7d64bc414eb2565","repo":"nats-io/nats-server","slug":"invalid-type-value-v","errorCode":null,"errorMessage":"invalid type value: %+v","messagePattern":"invalid type value: %\\+v","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/ldap/dn.go","lineNumber":62,"sourceCode":"\tRDNs []*RelativeDN\n}\n\n// FromCertSubject takes a pkix.Name from a cert and returns a DN\n// that uses the same set.  Does not support multi value RDNs.\nfunc FromCertSubject(subject pkix.Name) (*DN, error) {\n\tdn := &DN{\n\t\tRDNs: make([]*RelativeDN, 0),\n\t}\n\tfor i := len(subject.Names) - 1; i >= 0; i-- {\n\t\tname := subject.Names[i]\n\t\toidString := name.Type.String()\n\t\ttypeName, ok := attributeTypeNames[oidString]\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"invalid type name: %+v\", name)\n\t\t}\n\t\tv, ok := name.Value.(string)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"invalid type value: %+v\", v)\n\t\t}\n\t\trdn := &RelativeDN{\n\t\t\tAttributes: []*AttributeTypeAndValue{\n\t\t\t\t{\n\t\t\t\t\tType:  typeName,\n\t\t\t\t\tValue: v,\n\t\t\t\t},\n\t\t\t},\n\t\t}\n\t\tdn.RDNs = append(dn.RDNs, rdn)\n\t}\n\treturn dn, nil\n}\n\n// FromRawCertSubject takes a raw subject from a certificate\n// and uses asn1.Unmarshal to get the individual RDNs in the\n// original order, including multi-value RDNs.\nfunc FromRawCertSubject(rawSubject []byte) (*DN, error) {","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/internal/ldap/dn.go#L44-L80","documentation":"After mapping the OID to a type name, FromCertSubject asserts that the RDN value is a Go string (name.Value.(string)). x509 names can carry non-string values (e.g. PrintableValue / int64-encoded serialNumber or country in encoded form); if the value is not a string the DN conversion cannot proceed and this error is returned.","triggerScenarios":"FromCertSubject receives a certificate whose subject.Names[i].Value is a non-string type (e.g. an int64 or []byte value from an oddly-encoded RDN), so the type assertion v, ok := name.Value.(string) fails.","commonSituations":"Certificates with DER-encoded INTEGER RDN values (like some serialNumber attributes), certificates produced by tooling that encodes values as non-UTF8String ASN.1 types, or malformed custom certificates.","solutions":["Convert the non-string RDN value to a string (fmt.Sprintf or ASN.1 decoding) before/while building the DN in dn.go.","Reissue the certificate so RDN values use UTF8String/PrintableString encoding.","Skip or normalize the offending attribute before calling FromCertSubject.","Inspect the certificate with openssl to confirm which RDN has the non-string encoding."],"exampleFix":"// before\ncountry = 840\n// after (reissue with string-encoded RDN)\ncountry = US","handlingStrategy":"type-guard","validationCode":"for _, n := range cert.Subject.Names {\n\tif _, ok := n.Value.(string); !ok {\n\t\treturn fmt.Errorf(\"subject attribute %s has non-string value %T\", n.Type, n.Value)\n\t}\n}","typeGuard":"func isStringRDN(n pkix.AttributeTypeAndValue) bool {\n\t_, ok := n.Value.(string)\n\treturn ok\n}","tryCatchPattern":"dn, err := ldap.FromCertSubject(cert)\nif err != nil {\n\tif strings.Contains(err.Error(), \"invalid type value\") {\n\t\t// normalize: re-encode the subject or reissue the certificate\n\t\treturn normalizeSubject(cert), nil\n\t}\n\treturn nil, err\n}","preventionTips":["Ensure your CA encodes RDN values as UTF8String/PrintableString.","Pre-validate cert.Subject.Names value types before calling FromCertSubject.","Reject or reissue certificates with INTEGER-encoded RDNs at ingestion time."],"tags":["ldap","x509","certificate","dn","type-assertion"],"backgroundTag":"invalid-rdn-value-type","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}