nats-io/nats-server · error

invalid type value: %+v

Error message

invalid type value: %+v

What it means

After mapping the OID to a type name, FromCertSubject asserts that the RDN value is a Go string (name.Value.(string)). x509 names can carry non-string values (e.g. PrintableValue / int64-encoded serialNumber or country in encoded form); if the value is not a string the DN conversion cannot proceed and this error is returned.

Source

Thrown at internal/ldap/dn.go:62

	RDNs []*RelativeDN
}

// FromCertSubject takes a pkix.Name from a cert and returns a DN
// that uses the same set.  Does not support multi value RDNs.
func FromCertSubject(subject pkix.Name) (*DN, error) {
	dn := &DN{
		RDNs: make([]*RelativeDN, 0),
	}
	for i := len(subject.Names) - 1; i >= 0; i-- {
		name := subject.Names[i]
		oidString := name.Type.String()
		typeName, ok := attributeTypeNames[oidString]
		if !ok {
			return nil, fmt.Errorf("invalid type name: %+v", name)
		}
		v, ok := name.Value.(string)
		if !ok {
			return nil, fmt.Errorf("invalid type value: %+v", v)
		}
		rdn := &RelativeDN{
			Attributes: []*AttributeTypeAndValue{
				{
					Type:  typeName,
					Value: v,
				},
			},
		}
		dn.RDNs = append(dn.RDNs, rdn)
	}
	return dn, nil
}

// FromRawCertSubject takes a raw subject from a certificate
// and uses asn1.Unmarshal to get the individual RDNs in the
// original order, including multi-value RDNs.
func FromRawCertSubject(rawSubject []byte) (*DN, error) {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Convert the non-string RDN value to a string (fmt.Sprintf or ASN.1 decoding) before/while building the DN in dn.go.
2. Reissue the certificate so RDN values use UTF8String/PrintableString encoding.
3. Skip or normalize the offending attribute before calling FromCertSubject.
4. Inspect the certificate with openssl to confirm which RDN has the non-string encoding.

Example fix

// before
country = 840
// after (reissue with string-encoded RDN)
country = US

for _, n := range cert.Subject.Names {
	if _, ok := n.Value.(string); !ok {
		return fmt.Errorf("subject attribute %s has non-string value %T", n.Type, n.Value)
	}
}

func isStringRDN(n pkix.AttributeTypeAndValue) bool {
	_, ok := n.Value.(string)
	return ok
}

dn, err := ldap.FromCertSubject(cert)
if err != nil {
	if strings.Contains(err.Error(), "invalid type value") {
		// normalize: re-encode the subject or reissue the certificate
		return normalizeSubject(cert), nil
	}
	return nil, err
}

When it happens

Trigger: FromCertSubject receives a certificate whose subject.Names[i].Value is a non-string type (e.g. an int64 or []byte value from an oddly-encoded RDN), so the type assertion v, ok := name.Value.(string) fails.

Common situations: Certificates with DER-encoded INTEGER RDN values (like some serialNumber attributes), certificates produced by tooling that encodes values as non-UTF8String ASN.1 types, or malformed custom certificates.

Related errors

• invalid type name: %+v
• error parsing X509 certificate/key pair: %v
• error parsing certificate: %v
• error parsing X509 certificate/key pair %d/%d: %v
• error parsing certificate %d/%d: %v

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/b7d64bc414eb2565. Report an issue: GitHub.