{"record":{"id":"e1da2dac8a47e8d5","repo":"arduino/Arduino","slug":"no-appropriate-commonname-or-subjectaltname-fields","errorCode":null,"errorMessage":"no appropriate commonName or subjectAltName fields were found","messagePattern":"no appropriate commonName or subjectAltName fields were found","errorType":"exception","errorClass":"CertificateError","httpStatus":null,"severity":"error","filePath":"arduino-core/src/processing/app/i18n/python/requests/packages/urllib3/packages/ssl_match_hostname/__init__.py","lineNumber":60,"sourceCode":"        # in subjectAltName\n        for sub in cert.get('subject', ()):\n            for key, value in sub:\n                # XXX according to RFC 2818, the most specific Common Name\n                # must be used.\n                if key == 'commonName':\n                    if _dnsname_to_pat(value).match(hostname):\n                        return\n                    dnsnames.append(value)\n    if len(dnsnames) > 1:\n        raise CertificateError(\"hostname %r \"\n            \"doesn't match either of %s\"\n            % (hostname, ', '.join(map(repr, dnsnames))))\n    elif len(dnsnames) == 1:\n        raise CertificateError(\"hostname %r \"\n            \"doesn't match %r\"\n            % (hostname, dnsnames[0]))\n    else:\n        raise CertificateError(\"no appropriate commonName or \"\n            \"subjectAltName fields were found\")\n","sourceCodeStart":42,"sourceCodeEnd":62,"githubUrl":"https://github.com/arduino/Arduino/blob/a0df6e0e83b652c72bc78b0a1376c54d6ebc3bee/arduino-core/src/processing/app/i18n/python/requests/packages/urllib3/packages/ssl_match_hostname/__init__.py#L42-L62","documentation":"This CertificateError is raised by match_hostname when the presented certificate contains NO usable CommonName or subjectAltName DNS entries at all, so there is nothing to compare the requested hostname against. It means the certificate is fundamentally unusable for hostname verification, not merely mismatched.","triggerScenarios":"During TLS connect(), the peer's certificate has an empty subjectAltName extension and no valid dNSName/CN fields (e.g. a cert with only an IP SAN, email SAN, or a CN of unusual type), so match_hostname builds an empty dnsnames list and falls into the else branch.","commonSituations":"Server using a certificate generated without -addext/-subj SANs; IP-address-only certificates on old Python (<2.7.9-style CN matching not applicable to the vendored code); enterprise MITM proxies presenting malformed certs; misconfigured CA issuing certs with only non-DNS identities.","solutions":["Reissue the server certificate including proper subjectAltName dNSName entries (modern TLS ignores CN; SAN is required).","Generate the cert with SANs, e.g. `openssl req -x509 -addext 'subjectAltName=DNS:myhost.local' ...`.","If a proxy is intercepting TLS, exclude it or install its root CA and ensure it presents well-formed certificates.","Temporarily verify with cert_reqs='CERT_NONE' in a custom connection pool to confirm the diagnosis, then fix the cert."],"exampleFix":"// before\nopenssl req -x509 -newkey rsa:2048 -nodes -keyout k.pem -out c.pem -subj '/CN=myhost.local'\n// after\nopenssl req -x509 -newkey rsa:2048 -nodes -keyout k.pem -out c.pem -subj '/CN=myhost.local' -addext 'subjectAltName=DNS:myhost.local'","handlingStrategy":"try-catch","validationCode":"import ssl, socket\nctx = ssl.create_default_context()\ntry:\n    with ctx.wrap_socket(socket.create_connection((host, 443)), server_hostname=host) as s:\n        der = s.getpeercert(True)\nexcept ssl.SSLError as e:\n    raise RuntimeError('Certificate unusable for %s: %s' % (host, e))","typeGuard":null,"tryCatchPattern":"from requests.exceptions import SSLError\ntry:\n    resp = requests.get(url, timeout=10)\nexcept SSLError as e:\n    if 'no appropriate commonName' in str(e):\n        log.error('Peer certificate at %s has no SAN/CN entries; reissue it', url)\n    raise","preventionTips":["Always generate certificates with subjectAltName entries; SAN is mandatory for modern clients.","Lint server certs in monitoring (check SAN presence with openssl x509).","Verify certs after any CA/proxy change in the environment.","Beware TLS-intercepting middleboxes; pin their root CA and ensure they re-sign properly."],"tags":["ssl","certificate","subjectaltname","network"],"backgroundTag":"ssl-certificate-verify-failed","analyzedSha":"a0df6e0e83b652c72bc78b0a1376c54d6ebc3bee","analyzedAt":"2026-09-06T10:13:38.901Z","contentChangedAt":"2026-09-06T10:13:38.901Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}