What causes "PROXY_CERTIFICATES_NOT_ALLOWED" in oven-sh/bun?

Remove proxy certificates from the chain served to fetch(); present the plain end-entity chain

oven-sh/bun · error · TypeError

PROXY_CERTIFICATES_NOT_ALLOWED

PROXY_CERTIFICATES_NOT_ALLOWED

Error message

PROXY_CERTIFICATES_NOT_ALLOWED

What it means

CertError::PROXY_CERTIFICATES_NOT_ALLOWED maps BoringSSL X509 verify code 40 (X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED) via get_cert_error_from_no() in src/http/lib.rs:1559. RFC 3820 proxy certificates were found in the chain, but proxy-certificate acceptance is not enabled for this verification context (BoringSSL's X509_V_FLAG_ALLOW_PROXY_CERTS is off), so the chain fails. JS error.code is PROXY_CERTIFICATES_NOT_ALLOWED with message 'proxy certificates not allowed, please set the appropriate flag' (FetchTasklet.rs:1452).

Source

Thrown at src/http/error.rs:201

    #[error("AKID_ISSUER_SERIAL_MISMATCH")]
    AKID_ISSUER_SERIAL_MISMATCH,
    #[error("KEYUSAGE_NO_CERTSIGN")]
    KEYUSAGE_NO_CERTSIGN,
    #[error("UNABLE_TO_GET_CRL_ISSUER")]
    UNABLE_TO_GET_CRL_ISSUER,
    #[error("UNHANDLED_CRITICAL_EXTENSION")]
    UNHANDLED_CRITICAL_EXTENSION,
    #[error("KEYUSAGE_NO_CRL_SIGN")]
    KEYUSAGE_NO_CRL_SIGN,
    #[error("UNHANDLED_CRITICAL_CRL_EXTENSION")]
    UNHANDLED_CRITICAL_CRL_EXTENSION,
    #[error("INVALID_NON_CA")]
    INVALID_NON_CA,
    #[error("PROXY_PATH_LENGTH_EXCEEDED")]
    PROXY_PATH_LENGTH_EXCEEDED,
    #[error("KEYUSAGE_NO_DIGITAL_SIGNATURE")]
    KEYUSAGE_NO_DIGITAL_SIGNATURE,
    #[error("PROXY_CERTIFICATES_NOT_ALLOWED")]
    PROXY_CERTIFICATES_NOT_ALLOWED,
    #[error("INVALID_EXTENSION")]
    INVALID_EXTENSION,
    #[error("INVALID_POLICY_EXTENSION")]
    INVALID_POLICY_EXTENSION,
    #[error("NO_EXPLICIT_POLICY")]
    NO_EXPLICIT_POLICY,
    #[error("DIFFERENT_CRL_SCOPE")]
    DIFFERENT_CRL_SCOPE,
    #[error("UNSUPPORTED_EXTENSION_FEATURE")]
    UNSUPPORTED_EXTENSION_FEATURE,
    #[error("UNNESTED_RESOURCE")]
    UNNESTED_RESOURCE,
    #[error("PERMITTED_VIOLATION")]
    PERMITTED_VIOLATION,
    #[error("EXCLUDED_VIOLATION")]
    EXCLUDED_VIOLATION,
    #[error("SUBTREE_MINMAX")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Remove proxy certificates from the chain served to fetch(); present the plain end-entity chain
Terminate the proxy at a gateway that presents a normal TLS cert (gateway holds the proxy, not the browser/fetch client)
Reissue the endpoint with a standard server certificate (no proxyCertInfo extension)
There is no fetch() option to enable proxy certs — do not attempt to bypass with rejectUnauthorized:false outside throwaway tests

Example fix

# before: fullchain.pem = proxy.pem + ee.pem + int.pem
# after: fullchain.pem = ee.pem + int.pem
# proxy credentials move to the application layer (Authorization header), not TLS
await fetch("https://gateway.example.org/job", {
  headers: { Authorization: `Bearer ${proxyToken}` },
});

Defensive patterns

Strategy: try-catch

Validate before calling

import { X509Certificate } from "node:crypto";
const cert = new X509Certificate(await Bun.file("cert.pem").text());
const text = await Bun.$`openssl x509 -in cert.pem -noout -text`.text();
if (/Proxy Certificate Information|proxyCertInfo/i.test(text)) {
  throw new Error("proxy cert in chain — fetch() verification cannot allow proxy certificates");
}

Type guard

function isProxyCertsNotAllowed(e: unknown): e is Error & { code: "PROXY_CERTIFICATES_NOT_ALLOWED" } {
  return e instanceof Error && (e as any).code === "PROXY_CERTIFICATES_NOT_ALLOWED";
}

Try / catch

try { await fetch(url); } catch (e) { if (isProxyCertsNotAllowed(e)) { routeViaGatewayWithoutProxyCert(url); throw e; } throw e; }

Prevention

Keep RFC 3820 proxy certs out of served TLS chains
Move delegation credentials to application-layer headers
Use plain server certificates for fetch()-reachable endpoints

When it happens

Trigger: TLS endpoint presents a chain containing proxy certificates (proxyCertInfo extension, grid/VO proxies); Bun's fetch/Bun.connect verification contexts never set the allow-proxy flag, so any proxy cert aborts verification.

Common situations: Grid computing / science-Gateway endpoints that expect X.509 proxy auth, delegated-credential experiments, proxies accidentally bundled into fullchain.pem by pipeline tooling.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/1d0ee458bbb2941d. Report an issue: GitHub.