{"record":{"id":"cefcfe6c5ef82a6a","repo":"oven-sh/bun","slug":"unsupported-constraint-syntax","errorCode":"UNSUPPORTED_CONSTRAINT_SYNTAX","errorMessage":"UNSUPPORTED_CONSTRAINT_SYNTAX","messagePattern":"UNSUPPORTED_CONSTRAINT_SYNTAX","errorType":"error_code","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":225,"sourceCode":"    #[error(\"NO_EXPLICIT_POLICY\")]\n    NO_EXPLICIT_POLICY,\n    #[error(\"DIFFERENT_CRL_SCOPE\")]\n    DIFFERENT_CRL_SCOPE,\n    #[error(\"UNSUPPORTED_EXTENSION_FEATURE\")]\n    UNSUPPORTED_EXTENSION_FEATURE,\n    #[error(\"UNNESTED_RESOURCE\")]\n    UNNESTED_RESOURCE,\n    #[error(\"PERMITTED_VIOLATION\")]\n    PERMITTED_VIOLATION,\n    #[error(\"EXCLUDED_VIOLATION\")]\n    EXCLUDED_VIOLATION,\n    #[error(\"SUBTREE_MINMAX\")]\n    SUBTREE_MINMAX,\n    #[error(\"APPLICATION_VERIFICATION\")]\n    APPLICATION_VERIFICATION,\n    #[error(\"UNSUPPORTED_CONSTRAINT_TYPE\")]\n    UNSUPPORTED_CONSTRAINT_TYPE,\n    #[error(\"UNSUPPORTED_CONSTRAINT_SYNTAX\")]\n    UNSUPPORTED_CONSTRAINT_SYNTAX,\n    #[error(\"UNSUPPORTED_NAME_SYNTAX\")]\n    UNSUPPORTED_NAME_SYNTAX,\n    #[error(\"CRL_PATH_VALIDATION_ERROR\")]\n    CRL_PATH_VALIDATION_ERROR,\n    #[error(\"SUITE_B_INVALID_VERSION\")]\n    SUITE_B_INVALID_VERSION,\n    #[error(\"SUITE_B_INVALID_ALGORITHM\")]\n    SUITE_B_INVALID_ALGORITHM,\n    #[error(\"SUITE_B_INVALID_CURVE\")]\n    SUITE_B_INVALID_CURVE,\n    #[error(\"SUITE_B_INVALID_SIGNATURE_ALGORITHM\")]\n    SUITE_B_INVALID_SIGNATURE_ALGORITHM,\n    #[error(\"SUITE_B_LOS_NOT_ALLOWED\")]\n    SUITE_B_LOS_NOT_ALLOWED,\n    #[error(\"SUITE_B_CANNOT_SIGN_P_384_WITH_P_256\")]\n    SUITE_B_CANNOT_SIGN_P_384_WITH_P_256,\n    #[error(\"HOSTNAME_MISMATCH\")]","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L207-L243","documentation":"CertError::UNSUPPORTED_CONSTRAINT_SYNTAX maps BoringSSL X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX (verify code 52). The contents of a nameConstraints subtree are syntactically invalid or unsupported for its type - e.g. a URI constraint carrying a full host instead of a bare scheme, an email constraint with a malformed domain, or a DNS constraint that is not a valid domain. Message: \"unsupported or invalid name constraint syntax\".","triggerScenarios":"CA issues nameConstraints where the value does not follow RFC 5280's per-type syntax rules; the verifier parses the extension and rejects the subtree encoding.","commonSituations":"URI constraints written as 'https://example.com' instead of scheme-only 'https'; DNS constraints containing wildcards, leading dots, or spaces; email constraints missing the '@' domain form; template typos in CA tooling.","solutions":["Dump and eyeball the constraint values: openssl x509 -in ca.pem -noout -text","Fix per RFC 5280: URI constraints = scheme only ('https'), DNS = bare domain suffix ('example.com'), email = domain after '@' or full address","Reissue the CA with corrected constraints, then reissue/re-validate the chain"],"exampleFix":"# before: URI constraint as a full URL (invalid syntax)\nnameConstraints = permitted;URI:https://example.com/path\n\n# after: scheme-only URI constraint\nnameConstraints = permitted;URI:https","handlingStrategy":"validation","validationCode":"// Validate constraint values against RFC 5280 per-type syntax before signing the CA\nexport function constraintSyntaxOk(type, value) {\n  switch (type) {\n    case \"URI\": return /^[a-z][a-z0-9+.-]*$/.test(value);      // scheme only\n    case \"DNS\": return /^[a-z0-9.-]+$/i.test(value) && !value.startsWith(\".\");\n    case \"email\": return /@/.test(value) || /^[a-z0-9.-]+$/i.test(value);\n    case \"IP\": return value.includes(\"/\");\n    default: return false;\n  }\n}","typeGuard":"export function isUnsupportedConstraintSyntax(e): e is Error & { code: \"UNSUPPORTED_CONSTRAINT_SYNTAX\" } {\n  return e instanceof Error && (e as any).code === \"UNSUPPORTED_CONSTRAINT_SYNTAX\";\n}","tryCatchPattern":"try {\n  await fetch(url);\n} catch (e) {\n  if (e?.code === \"UNSUPPORTED_CONSTRAINT_SYNTAX\") {\n    // a name-constraint value violates its type's syntax (e.g. URI constraint not scheme-only)\n    sendCaFix(\"constraint-syntax\", url);\n  } else throw e;\n}","preventionTips":["Memorize the rule: URI constraints are schemes ('https'), never URLs","Add per-type syntax validation to CA issuance tooling","Round-trip new CA certs through openssl verify with a constrained leaf before shipping"],"tags":["tls","x509","name-constraints","rfc5280","pki","fetch","security"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}