oven-sh/bun · error · TypeError

EXCLUDED_VIOLATION

EXCLUDED_VIOLATION

Error message

EXCLUDED_VIOLATION

What it means

CertError::EXCLUDED_VIOLATION maps BoringSSL X509_V_ERR_EXCLUDED_VIOLATION (verify code 48). A CA's nameConstraints excludedSubtrees explicitly forbids a name space, and the certificate being validated contains a SAN/subject inside an excluded subtree. Message: "excluded subtree violation".

Source

Thrown at src/http/error.rs:217

    #[error("KEYUSAGE_NO_DIGITAL_SIGNATURE")]
    KEYUSAGE_NO_DIGITAL_SIGNATURE,
    #[error("PROXY_CERTIFICATES_NOT_ALLOWED")]
    PROXY_CERTIFICATES_NOT_ALLOWED,
    #[error("INVALID_EXTENSION")]
    INVALID_EXTENSION,
    #[error("INVALID_POLICY_EXTENSION")]
    INVALID_POLICY_EXTENSION,
    #[error("NO_EXPLICIT_POLICY")]
    NO_EXPLICIT_POLICY,
    #[error("DIFFERENT_CRL_SCOPE")]
    DIFFERENT_CRL_SCOPE,
    #[error("UNSUPPORTED_EXTENSION_FEATURE")]
    UNSUPPORTED_EXTENSION_FEATURE,
    #[error("UNNESTED_RESOURCE")]
    UNNESTED_RESOURCE,
    #[error("PERMITTED_VIOLATION")]
    PERMITTED_VIOLATION,
    #[error("EXCLUDED_VIOLATION")]
    EXCLUDED_VIOLATION,
    #[error("SUBTREE_MINMAX")]
    SUBTREE_MINMAX,
    #[error("APPLICATION_VERIFICATION")]
    APPLICATION_VERIFICATION,
    #[error("UNSUPPORTED_CONSTRAINT_TYPE")]
    UNSUPPORTED_CONSTRAINT_TYPE,
    #[error("UNSUPPORTED_CONSTRAINT_SYNTAX")]
    UNSUPPORTED_CONSTRAINT_SYNTAX,
    #[error("UNSUPPORTED_NAME_SYNTAX")]
    UNSUPPORTED_NAME_SYNTAX,
    #[error("CRL_PATH_VALIDATION_ERROR")]
    CRL_PATH_VALIDATION_ERROR,
    #[error("SUITE_B_INVALID_VERSION")]
    SUITE_B_INVALID_VERSION,
    #[error("SUITE_B_INVALID_ALGORITHM")]
    SUITE_B_INVALID_ALGORITHM,
    #[error("SUITE_B_INVALID_CURVE")]

View on GitHub (pinned to 8c5296ac45)

Solutions

  1. Read the exclusions: openssl x509 -in ca.pem -noout -text (Name Constraints, excluded subtrees)
  2. Move the service to a name outside the excluded subtree and reissue the SAN
  3. If the exclusion is obsolete, reissue the CA without that excludedSubtree (and re-key the chain)
  4. Confirm no other name in the cert (subject CN, email, URI, IP SANs) also lands in an exclusion

Example fix

# before: CA excludes DNS:legacy.example.com ; leaf SAN collides
subjectAltName = DNS:app.legacy.example.com

# after: serve under a non-excluded name
subjectAltName = DNS:app.example.com
Defensive patterns

Strategy: validation

Validate before calling

// Check requested SANs against the CA's exclusion list before issuance
export function sansAvoidExclusions(sans /* string[] */, excluded /* e.g. ["legacy.example.com", "10.0.0.0/8"] */) {
  const inSubnet = (ip, cidr) => { /* CIDR containment check */ return true; };
  return sans.every((san) => !excluded.some((ex) =>
    ex.includes("/") ? inSubnet(san, ex)
    : san === ex || san.endsWith("." + ex)
  ));
}

Type guard

export function isExcludedViolation(e): e is Error & { code: "EXCLUDED_VIOLATION" } {
  return e instanceof Error && (e as any).code === "EXCLUDED_VIOLATION";
}

Try / catch

try {
  await fetch(url);
} catch (e) {
  if (e?.code === "EXCLUDED_VIOLATION") {
    // name is explicitly excluded by a CA's nameConstraints - pick another name or drop the exclusion
    relabelService(new URL(url).hostname);
  } else throw e;
}

Prevention

When it happens

Trigger: CA declares excludedSubtrees = DNS:legacy.example.com (or IP:10.0.0.0/8, email:@internal), and a leaf was issued containing exactly such a name. Exclusions override permitted subtrees.

Common situations: Orgs that excluded retired/deprecated domains from a CA, then a cert is minted for one of them; security teams excluding internal ranges from externally-issued certs; CA operators using exclusions to carve out exceptions that later collide with new issuance requests.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/6ff7c9621de2e687. Report an issue: GitHub.