oven-sh/bun · error · TypeError

PROXY_PATH_LENGTH_EXCEEDED

PROXY_PATH_LENGTH_EXCEEDED

Error message

PROXY_PATH_LENGTH_EXCEEDED

What it means

CertError::PROXY_PATH_LENGTH_EXCEEDED maps BoringSSL X509 verify code 38 (X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED) via get_cert_error_from_no() in src/http/lib.rs:1557. An RFC 3820 proxy certificate chain violates a proxy path length constraint embedded in a proxy cert of the chain. JS error.code is PROXY_PATH_LENGTH_EXCEEDED with message 'proxy path length constraint exceeded' (FetchTasklet.rs:1449).

Source

Thrown at src/http/error.rs:197

    #[error("SUBJECT_ISSUER_MISMATCH")]
    SUBJECT_ISSUER_MISMATCH,
    #[error("AKID_SKID_MISMATCH")]
    AKID_SKID_MISMATCH,
    #[error("AKID_ISSUER_SERIAL_MISMATCH")]
    AKID_ISSUER_SERIAL_MISMATCH,
    #[error("KEYUSAGE_NO_CERTSIGN")]
    KEYUSAGE_NO_CERTSIGN,
    #[error("UNABLE_TO_GET_CRL_ISSUER")]
    UNABLE_TO_GET_CRL_ISSUER,
    #[error("UNHANDLED_CRITICAL_EXTENSION")]
    UNHANDLED_CRITICAL_EXTENSION,
    #[error("KEYUSAGE_NO_CRL_SIGN")]
    KEYUSAGE_NO_CRL_SIGN,
    #[error("UNHANDLED_CRITICAL_CRL_EXTENSION")]
    UNHANDLED_CRITICAL_CRL_EXTENSION,
    #[error("INVALID_NON_CA")]
    INVALID_NON_CA,
    #[error("PROXY_PATH_LENGTH_EXCEEDED")]
    PROXY_PATH_LENGTH_EXCEEDED,
    #[error("KEYUSAGE_NO_DIGITAL_SIGNATURE")]
    KEYUSAGE_NO_DIGITAL_SIGNATURE,
    #[error("PROXY_CERTIFICATES_NOT_ALLOWED")]
    PROXY_CERTIFICATES_NOT_ALLOWED,
    #[error("INVALID_EXTENSION")]
    INVALID_EXTENSION,
    #[error("INVALID_POLICY_EXTENSION")]
    INVALID_POLICY_EXTENSION,
    #[error("NO_EXPLICIT_POLICY")]
    NO_EXPLICIT_POLICY,
    #[error("DIFFERENT_CRL_SCOPE")]
    DIFFERENT_CRL_SCOPE,
    #[error("UNSUPPORTED_EXTENSION_FEATURE")]
    UNSUPPORTED_EXTENSION_FEATURE,
    #[error("UNNESTED_RESOURCE")]
    UNNESTED_RESOURCE,
    #[error("PERMITTED_VIOLATION")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Flatten the delegation: use a single-level proxy certificate rather than chained proxies
2. Regenerate the proxy with a sufficient proxy path length (e.g., myproxy-init -p or grid-proxy-init with matching limits)
3. Avoid routing fetch() traffic through endpoints that require stacked proxy certs; use a plain TLS chain
4. Identify the constraint: openssl x509 -in proxy.pem -noout -text | grep -i -A2 'proxy'

Example fix

# before: proxy2 -> proxy1(ppathlen:0) -> ee  (rejected)
# after: single-level proxy
grid-proxy-init -hours 12   # or:
openssl x509 -req -in proxy.csr -signkey user-key.pem \
  -extfile <(printf 'proxyCertInfo=critical,language:1.3.6.1.5.5.7.21.1,pathlen:1') \
  -out proxy.pem -days 1

import { X509Certificate } from "node:crypto";
const cert = new X509Certificate(await Bun.file("proxy.pem").text());
const text = await Bun.$`openssl x509 -in proxy.pem -noout -text`.text();
const ppathlen = text.match(/Path Length:(\d+)/)?.[1];
if (ppathlen !== undefined && Number(ppathlen) < 1) {
  throw new Error("proxy pathlen forbids further delegation");
}

function isProxyPathLenExceeded(e: unknown): e is Error & { code: "PROXY_PATH_LENGTH_EXCEEDED" } {
  return e instanceof Error && (e as any).code === "PROXY_PATH_LENGTH_EXCEEDED";
}

try { await fetch(url); } catch (e) { if (isProxyPathLenExceeded(e)) { reissueFlatProxy(new URL(url).host); throw e; } throw e; }

When it happens

Trigger: TLS handshake where the presented chain contains RFC 3820 proxy certificates and the number of subsequent proxy certs exceeds the ppathlen constraint declared by one of them (delegated-credential/proxy-style setups, grid-computing X.509 proxies stacked too deep).

Common situations: Grid/academic X.509 proxy deployments (VOMS proxies with limited delegation), experimental delegation setups, proxies generated with ppathlen:0 then further delegated.

Related errors

• PROXY_CERTIFICATES_NOT_ALLOWED
• UNABLE_TO_VERIFY_LEAF_SIGNATURE
• CERT_CHAIN_TOO_LONG
• INVALID_CA
• PATH_LENGTH_EXCEEDED

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/1d7ef80611bc9b36. Report an issue: GitHub.