{"record":{"id":"f48f596709111b72","repo":"NationalSecurityAgency/ghidra","slug":"missing-common-name-attribute","errorCode":null,"errorMessage":"Missing common name attribute","messagePattern":"Missing common name attribute","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java","lineNumber":425,"sourceCode":"\t * X509 certificate distinguished name. Try to extract the common name portion of the\n\t * distinguished name and assign it to -commonName- \n\t * @throws IllegalArgumentException if the distinguished name is improperly formatted or the common name is missing\n\t */\n\tprivate void validateDistinguishedName() throws IllegalArgumentException {\n\t\tif (distinguishedName == null) {\n\t\t\treturn;\n\t\t}\n\t\tcommonName = null;\n\t\ttry {\n\t\t\tLdapName ldapName = new LdapName(distinguishedName);\n\t\t\tfor (Rdn rdn : ldapName.getRdns()) {\n\t\t\t\tif (rdn.getType().equalsIgnoreCase(\"CN\")) {\n\t\t\t\t\tcommonName = rdn.getValue().toString();\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (commonName == null) {\n\t\t\t\tthrow new IllegalArgumentException(\"Missing common name attribute\");\n\t\t\t}\n\t\t}\n\t\tcatch (Exception e) {\n\t\t\tthrow new IllegalArgumentException(\"Improperly formatted distinguished name\");\n\t\t}\n\t}\n\n\t/**\n\t * @return true if the server (referred to by -postgresRoot-) is running\n\t * @throws IOException if there is a problem running the command\n\t * @throws InterruptedException if there is a problem running the command\n\t */\n\tprivate boolean isServerRunning() throws IOException, InterruptedException {\n\t\tFile createCommand = new File(postgresRoot, \"bin/pg_isready\");\n\t\tList<String> command = new ArrayList<String>();\n\t\tcommand.add(createCommand.getAbsolutePath());\n\t\tif ((port != -1) && (port != 5432)) {\t// Non-default port\n\t\t\tcommand.add(\"-p\");","sourceCodeStart":407,"sourceCodeEnd":443,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java#L407-L443","documentation":"Thrown by validateDistinguishedName when the --dn LDAP distinguished name parses successfully (via LdapName) but contains no CN (commonName) RDN. PKI authentication setup requires a CN to build the certificate subject, so its absence is fatal.","triggerScenarios":"Passing a DN with no CN= component, e.g. `--dn \"O=Acme,OU=Eng\"`. The loop finds no RDN whose type equals 'CN' (case-insensitive) and throws at line 425.","commonSituations":"Using an org/OU-only DN, forgetting the CN, or copying a DN format from a system that does not require CN.","solutions":["Add a CN= component to the DN, e.g. \"CN=bsim-server,O=Acme\".","Ensure CN appears at least once; the parser takes the first CN found.","Keep attribute syntax RFC 2253 compliant (key=value, comma-separated)."],"exampleFix":"// before\nbsim control configure host --auth pki --dn \"O=Acme,OU=Eng\"\n// after\nbsim control configure host --auth pki --dn \"CN=bsim-server,O=Acme,OU=Eng\"","handlingStrategy":"validation","validationCode":"// Require a CN= component in the DN before passing it to the tool.\nboolean hasCn = false;\nfor (String part : dn.split(\",\")) {\n    String kv[] = part.split(\"=\", 2);\n    if (kv.length == 2 && kv[0].trim().equalsIgnoreCase(\"CN\") && !kv[1].trim().isEmpty()) {\n        hasCn = true;\n        break;\n    }\n}\nif (!hasCn) {\n    System.err.println(\"DN must contain a CN= component: \" + dn);\n    return;\n}","typeGuard":null,"tryCatchPattern":"try {\n    launchable.validateDistinguishedName();\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().equals(\"Missing common name attribute\")) {\n        System.err.println(\"Add CN=<name> to the distinguished name.\");\n    }\n    throw e;\n}","preventionTips":["Always include at least one CN= attribute in PKI distinguished names.","Validate the DN structurally before passing it to the tool.","Keep DN values RFC 2253 compliant and CN-first where possible."],"tags":["cli","pki","certificate","validation","security"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}