{"record":{"id":"ea09108bdc3d3b50","repo":"oven-sh/bun","slug":"subtree-minmax","errorCode":"SUBTREE_MINMAX","errorMessage":"SUBTREE_MINMAX","messagePattern":"SUBTREE_MINMAX","errorType":"error_code","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":219,"sourceCode":"    #[error(\"PROXY_CERTIFICATES_NOT_ALLOWED\")]\n    PROXY_CERTIFICATES_NOT_ALLOWED,\n    #[error(\"INVALID_EXTENSION\")]\n    INVALID_EXTENSION,\n    #[error(\"INVALID_POLICY_EXTENSION\")]\n    INVALID_POLICY_EXTENSION,\n    #[error(\"NO_EXPLICIT_POLICY\")]\n    NO_EXPLICIT_POLICY,\n    #[error(\"DIFFERENT_CRL_SCOPE\")]\n    DIFFERENT_CRL_SCOPE,\n    #[error(\"UNSUPPORTED_EXTENSION_FEATURE\")]\n    UNSUPPORTED_EXTENSION_FEATURE,\n    #[error(\"UNNESTED_RESOURCE\")]\n    UNNESTED_RESOURCE,\n    #[error(\"PERMITTED_VIOLATION\")]\n    PERMITTED_VIOLATION,\n    #[error(\"EXCLUDED_VIOLATION\")]\n    EXCLUDED_VIOLATION,\n    #[error(\"SUBTREE_MINMAX\")]\n    SUBTREE_MINMAX,\n    #[error(\"APPLICATION_VERIFICATION\")]\n    APPLICATION_VERIFICATION,\n    #[error(\"UNSUPPORTED_CONSTRAINT_TYPE\")]\n    UNSUPPORTED_CONSTRAINT_TYPE,\n    #[error(\"UNSUPPORTED_CONSTRAINT_SYNTAX\")]\n    UNSUPPORTED_CONSTRAINT_SYNTAX,\n    #[error(\"UNSUPPORTED_NAME_SYNTAX\")]\n    UNSUPPORTED_NAME_SYNTAX,\n    #[error(\"CRL_PATH_VALIDATION_ERROR\")]\n    CRL_PATH_VALIDATION_ERROR,\n    #[error(\"SUITE_B_INVALID_VERSION\")]\n    SUITE_B_INVALID_VERSION,\n    #[error(\"SUITE_B_INVALID_ALGORITHM\")]\n    SUITE_B_INVALID_ALGORITHM,\n    #[error(\"SUITE_B_INVALID_CURVE\")]\n    SUITE_B_INVALID_CURVE,\n    #[error(\"SUITE_B_INVALID_SIGNATURE_ALGORITHM\")]","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L201-L237","documentation":"CertError::SUBTREE_MINMAX maps BoringSSL X509_V_ERR_SUBTREE_MINMAX (verify code 49). A nameConstraints GeneralSubtree carries a nonzero minimum or maximum field; RFC 5280 requires both to be absent/zero in certificates, so the verifier rejects it. Message: \"name constraints minimum and maximum not supported\".","triggerScenarios":"A CA cert's nameConstraints DER encodes base/min/max where min>0 or max is set. Some ASN.1 tooling lets you set these; X.509 conformant verifiers refuse.","commonSituations":"CAs generated through generic ASN.1 editors or exotic libraries that expose min/max; test CA templates ported from academic examples; rarely seen from commercial CAs.","solutions":["Confirm the encoding: openssl x509 -in ca.pem -noout -text and look for minimum/maximum under Name Constraints","Regenerate the CA cert with plain subtrees (no min/max) and reissue the chain beneath it","Switch to a mainstream generation path (openssl, cfssl, step-ca) that omits these fields by default"],"exampleFix":"# before (ASN.1 template exposing min/max)\nGeneralSubtree ::= SEQUENCE { base DNS:example.com, minimum 1, maximum 99 }\n\n# after (conformant: fields omitted, i.e. zero)\nGeneralSubtree ::= SEQUENCE { base DNS:example.com }","handlingStrategy":"validation","validationCode":"// Reject CA templates that set nameConstraints minimum/maximum before signing\nimport { execFileSync } from \"node:child_process\";\nexport function noSubtreeMinMax(caPem) {\n  const txt = execFileSync(\"openssl\", [\"x509\", \"-noout\", \"-text\"], { input: caPem }).toString();\n  return !/(Name Constraints[\\s\\S]*?)\\b(minimum|maximum)\\b/.test(txt);\n}","typeGuard":"export function isSubtreeMinMax(e): e is Error & { code: \"SUBTREE_MINMAX\" } {\n  return e instanceof Error && (e as any).code === \"SUBTREE_MINMAX\";\n}","tryCatchPattern":"try {\n  await fetch(url);\n} catch (e) {\n  if (e?.code === \"SUBTREE_MINMAX\") {\n    // CA's nameConstraints carry nonzero min/max - regenerate the CA without them\n    notifyCaOwners(url);\n  } else throw e;\n}","preventionTips":["Generate CA nameConstraints only with openssl/cfssl - they omit min/max by construction","Add an ASN.1 lint (no minimum/maximum fields) to your CA issuance CI","Never port name-constraint examples from RFCs verbatim; some illustrate fields that are invalid in certs"],"tags":["tls","x509","name-constraints","asn1","pki","fetch","security"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}