nats-io/nats-server · error

invalid type name: %+v

Error message

invalid type name: %+v

What it means

FromCertSubject converts an x509 certificate subject into the library's DN representation by mapping each RDN name's OID (name.Type.String()) through the attributeTypeNames lookup table. If an OID in the certificate subject has no entry in that table, the conversion fails since the library cannot express that attribute type.

Source

Thrown at internal/ldap/dn.go:58

}

// DN represents a distinguishedName from https://tools.ietf.org/html/rfc4514
type DN struct {
	RDNs []*RelativeDN
}

// FromCertSubject takes a pkix.Name from a cert and returns a DN
// that uses the same set.  Does not support multi value RDNs.
func FromCertSubject(subject pkix.Name) (*DN, error) {
	dn := &DN{
		RDNs: make([]*RelativeDN, 0),
	}
	for i := len(subject.Names) - 1; i >= 0; i-- {
		name := subject.Names[i]
		oidString := name.Type.String()
		typeName, ok := attributeTypeNames[oidString]
		if !ok {
			return nil, fmt.Errorf("invalid type name: %+v", name)
		}
		v, ok := name.Value.(string)
		if !ok {
			return nil, fmt.Errorf("invalid type value: %+v", v)
		}
		rdn := &RelativeDN{
			Attributes: []*AttributeTypeAndValue{
				{
					Type:  typeName,
					Value: v,
				},
			},
		}
		dn.RDNs = append(dn.RDNs, rdn)
	}
	return dn, nil
}

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Add the missing OID-to-name mapping to attributeTypeNames in internal/ldap/dn.go and rebuild.
2. Reissue/obtain a certificate whose subject uses only standard supported attributes.
3. Filter or transform the certificate subject before calling FromCertSubject to drop unsupported attributes.
4. Report the missing OID upstream so the table can be extended.

Example fix

// before (dn.go)
var attributeTypeNames = map[string]string{
	"2.5.4.3": "CN",
	"2.5.4.10": "O",
}
// after
var attributeTypeNames = map[string]string{
	"2.5.4.3": "CN",
	"2.5.4.10": "O",
	"0.9.2342.19200300.100.1.25": "DC", // add missing OID
}

for _, n := range cert.Subject.Names {
	if _, ok := attributeTypeNames[n.Type.String()]; !ok {
		return fmt.Errorf("unsupported subject OID %s", n.Type.String())
	}
}

dn, err := ldap.FromCertSubject(cert)
if err != nil {
	if strings.Contains(err.Error(), "invalid type name") {
		// fall back to raw subject string or reissue the cert
		return cert.Subject.String(), nil
	}
	return "", err
}

When it happens

Trigger: FromCertSubject is called with a cert whose subject.Names contains an attribute OID not present in attributeTypeNames (only common standard OIDs like CN, O, OU, C, ST, L, etc. are mapped).

Common situations: Certificates issued with unusual or custom extension attributes in the subject (e.g. enterprise-specific OIDs, emailAddress variants, serialNumber, DC components), or certificates from non-standard CAs using OIDs the table doesn't cover.

Related errors

• invalid type value: %+v
• error parsing X509 certificate/key pair: %v
• error parsing certificate: %v
• error parsing X509 certificate/key pair %d/%d: %v
• error parsing certificate %d/%d: %v

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/6ff4e4a32d04228d. Report an issue: GitHub.