gravitational/teleport · error

want closing quote, found EOF

Error message

want closing quote, found EOF

What it means

The DN tokenizer reached EOF while in tokenizeStateStringQuote, meaning a quoted string value inside the distinguished name was opened with '"' but never closed. RFC 4514-style DN values may be double-quoted; the tokenizer tracks quote state and fails when input ends while still inside quotes.

Source

Thrown at api/utils/pkixname/parser.go:587

	}

	// Input ended, check the final state.
	switch state {
	case tokenizeStateInit:
		// OK.
	case tokenizeStateNameComponent:
		return nil, fmt.Errorf("want attributeType, found EOF")
	case tokenizeStateAttrType:
		return nil, fmt.Errorf("want attributeType or '=', found EOF")
	case tokenizeStateAttrTypeEnd:
		return nil, fmt.Errorf("want '=' attributeValue, found EOF")
	case tokenizeStateStringStart, tokenizeStateString, tokenizeStateStringEnd:
		// OK.
		emitBuffer(tokenString)
	case tokenizeStateStringEscape:
		return nil, fmt.Errorf("want escaped character, found EOF")
	case tokenizeStateStringQuote:
		return nil, fmt.Errorf("want closing quote, found EOF")
	case tokenizeStateStringQuoteEnd:
		// OK.
	default:
		// This should not be reached. All states are handled above.
		return nil, fmt.Errorf("found EOF (state=%d)", state)
	}

	return tokens, nil
}

func isAttrType(r rune) bool {
	return r >= 'A' && r <= 'Z' ||
		r >= 'a' && r <= 'z' ||
		r >= '0' && r <= '9' ||
		r == '-' ||
		r == '.'
}

View on GitHub (pinned to 1283425b60)

Solutions

1. Add the missing closing quote: "CN=\"my server\"".
2. Remove the quotes entirely and escape special characters with backslash instead (RFC 4514 escaping).
3. Count quote characters (must be even) in a pre-parse sanity check on the DN string.

Example fix

// before
name, err := pkixname.ParseDistinguishedName("CN=\"teleport proxy")
// after
name, err := pkixname.ParseDistinguishedName("CN=\"teleport proxy\"")

func hasBalancedQuotes(dn string) bool {
	inQuote, escaped := false, false
	for _, r := range dn {
		if escaped { escaped = false; continue }
		if r == '\\' { escaped = true; continue }
		if r == '"' { inQuote = !inQuote }
	}
	return !inQuote && !escaped
}
if !hasBalancedQuotes(rawDN) { return errors.New("unbalanced quotes in DN") }

if err != nil {
	if strings.Contains(err.Error(), "want closing quote") {
		// fail fast with the offending DN; do not retry, input is malformed
	}
}

When it happens

Trigger: ParseDistinguishedName with an unbalanced quote, e.g. "CN=\"my server" or "OU=\"eng,O=corp" — the opening quote has no matching closing quote before the end of the string.

Common situations: Hand-edited TLS/SSH certificate subject fields; DNs pasted from documentation with quotes half-removed; values containing quotes produced by shell interpolation that stripped one of a pair of quotes.

Related errors

• want escaped character, found EOF
• found EOF (state=%d)
• distinguished name too large, refusing to parse
• unhandled size name: %v
• malformed RDNs: %w

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/8c42541f03f19650. Report an issue: GitHub.