certificate request contains no Common Name, DNS Name, nor…

Error message

certificate request contains no Common Name, DNS Name, nor URI SAN, at least one must be supplied to be used as the certificate objects name

What it means

getVcertFriendlyName derives the object name Venafi will use for the certificate, preferring CommonName, then DNS names, URI SANs, email addresses, and IP addresses. If the parsed certificate has none of these, it errors because a friendly name cannot be constructed. buildVReq calls it while assembling the Venafi request.

Solutions

Add at least one of: commonName, a DNS name, or a URI SAN to the certificate request.
Set spec.dnsNames (and/or ipAddresses, emailAddresses) on the Certificate resource.
Inspect the CSR with `openssl req -text` to confirm SAN extensions and CN are present.
If using ipAddresses/emails only for identity, note Venafi naming prefers CN/DNS/URI — add a CN to get a stable friendly name.

Example fix

// before
spec:
  organization: ["Example Corp"]
// after
spec:
  commonName: svc.example.com
  organization: ["Example Corp"]
  dnsNames: ["svc.example.com"]

Defensive patterns

Strategy: validation

Validate before calling

if len(csr.DNSNames) == 0 && csr.Subject.CommonName == "" && len(csr.URIs) == 0 &&
    len(csr.IPAddresses) == 0 && len(csr.EmailAddresses) == 0 {
    return errors.New("CSR must contain CN or at least one DNS/URI/IP/email SAN")
}

Try / catch

if err != nil && strings.Contains(err.Error(), "no Common Name, DNS Name, nor URI SAN") {
    // surface guidance to add commonName or dnsNames
}

Prevention

Require dnsNames or commonName in every Certificate spec
Reject empty-SAN CSRs at admission time
Verify SAN presence with `openssl req -text -noout`

When it happens

Trigger: Calling RequestCertificate with a CSR whose parsed x509.Certificate has no CommonName, no DNSNames, no URIs, no EmailAddresses, and no IPAddresses — e.g. only Organization/OU subject fields plus no SANs.

Common situations: CSRs generated with only a subject and no SAN extension; misconfigured Certificate resources with empty commonName and empty dnsNames; CSR parsing dropping SANs due to malformed extensions.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of cert-manager/cert-manager@79dd67caae (2026-09-07). Data as JSON: /api/errors/9208b8dc2e8c8e31. Report an issue: GitHub.

Appendix: source

Thrown at pkg/issuer/venafi/client/request.go:220

	return req
}

func getVcertFriendlyName(crt *x509.Certificate) (string, error) {
	// Set the 'ObjectName' through the vcert friendly name. This is set in
	// order of precedence CN->DNS->URI.
	switch {
	case len(crt.Subject.CommonName) > 0:
		return crt.Subject.CommonName, nil
	case len(crt.DNSNames) > 0:
		return crt.DNSNames[0], nil
	case len(crt.URIs) > 0:
		return crt.URIs[0].String(), nil
	case len(crt.EmailAddresses) > 0:
		return crt.EmailAddresses[0], nil
	case len(crt.IPAddresses) > 0:
		return crt.IPAddresses[0].String(), nil
	default:
		return "", errors.New("certificate request contains no Common Name, DNS Name, nor URI SAN, at least one must be supplied to be used as the certificate objects name")
	}
}

View on GitHub (pinned to 79dd67caae)