elastic/elasticsearch · error · SslConfigException

${s} is not a supported x509 field for trust restrictions. R

Error message

${s} is not a supported x509 field for trust restrictions. Recognised values are [${values}]

What it means

parseForRestrictedTrust accepts only X509Field enum values whose supportedForRestrictedTrust flag is true. Currently those are subjectAltName.otherName.commonName and subjectAltName.dnsName. The supplied string is matched case-insensitively against configValue; on miss it throws an SslConfigException that lists every configValue in the enum.

Source

Thrown at libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/X509Field.java:42

    X509Field(String configValue, boolean supportedForRestrictedTrust) {
        this.configValue = configValue;
        this.supportedForRestrictedTrust = supportedForRestrictedTrust;
    }

    @Override
    public String toString() {
        return configValue;
    }

    public static X509Field parseForRestrictedTrust(String s) {
        return EnumSet.allOf(X509Field.class)
            .stream()
            .filter(v -> v.supportedForRestrictedTrust)
            .filter(v -> v.configValue.equalsIgnoreCase(s))
            .findFirst()
            .orElseThrow(() -> {
                throw new SslConfigException(
                    s
                        + " is not a supported x509 field for trust restrictions. "
                        + "Recognised values are ["
                        + EnumSet.allOf(X509Field.class).stream().map(e -> e.configValue).collect(Collectors.toSet())
                        + "]"
                );
            });
    }
}

View on GitHub (pinned to db6a809a66)

Solutions

1. Use one of the two supported configValues: subjectAltName.otherName.commonName or subjectAltName.dnsName
2. Match the exact dotted spelling and case-insensitive casing shown in the error's recognised-values set
3. If you need a field not on the list, it is not supported for restricted trust - restructure the certificate to put the identity in a SAN instead

Example fix

// before
restrict_subject_alt_name: "dns"
// after
restrict_subject_alt_name: "subjectAltName.dnsName"

private static final Set<String> SUPPORTED = Set.of(
    "subjectAltName.otherName.commonName", "subjectAltName.dnsName");
String v = raw == null ? null : raw.trim();
if (v == null || !SUPPORTED.contains(v.toLowerCase(Locale.ROOT))) {
    throw new IllegalArgumentException("Unsupported x509 field for restricted trust: " + raw);
}
X509Field.parseForRestrictedTrust(v);

static boolean isSupportedX509Field(String s) {
    return s != null && Set.of("subjectAltName.otherName.commonName", "subjectAltName.dnsName")
        .contains(s.trim().toLowerCase(Locale.ROOT));
}

try { X509Field.parseForRestrictedTrust(s); }
catch (SslConfigException e) { throw new ConfigException(e.getMessage(), e); }

When it happens

Trigger: Configuring restricted trust (delegated/restricted trust manager) with an X.509 field name that is not one of the two supported SAN-based configValues, or has a typo.

Common situations: Using legacy names like commonName, cn, dns, subject_cn that the enum does not recognise; mis-typing subjectAltName.dnsName (e.g. subjectAltNames.dnsName, subject_alt_name.dns_name); copy-pasting from older documentation that used a different field vocabulary.

Related errors

• failed to parse any certificates from [{}]
• could not resolve ssl client verification mode, unknown valu
• the ${keystoreType} keystore [${path}]does not contain a pri
• the truststore [${path}] does not contain any trusted certif
• security exception

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/6b2acc54c6f85767. Report an issue: GitHub.