oven-sh/bun · error · TypeError

SUBTREE_MINMAX

SUBTREE_MINMAX

Error message

SUBTREE_MINMAX

What it means

CertError::SUBTREE_MINMAX maps BoringSSL X509_V_ERR_SUBTREE_MINMAX (verify code 49). A nameConstraints GeneralSubtree carries a nonzero minimum or maximum field; RFC 5280 requires both to be absent/zero in certificates, so the verifier rejects it. Message: "name constraints minimum and maximum not supported".

Source

Thrown at src/http/error.rs:219

    #[error("PROXY_CERTIFICATES_NOT_ALLOWED")]
    PROXY_CERTIFICATES_NOT_ALLOWED,
    #[error("INVALID_EXTENSION")]
    INVALID_EXTENSION,
    #[error("INVALID_POLICY_EXTENSION")]
    INVALID_POLICY_EXTENSION,
    #[error("NO_EXPLICIT_POLICY")]
    NO_EXPLICIT_POLICY,
    #[error("DIFFERENT_CRL_SCOPE")]
    DIFFERENT_CRL_SCOPE,
    #[error("UNSUPPORTED_EXTENSION_FEATURE")]
    UNSUPPORTED_EXTENSION_FEATURE,
    #[error("UNNESTED_RESOURCE")]
    UNNESTED_RESOURCE,
    #[error("PERMITTED_VIOLATION")]
    PERMITTED_VIOLATION,
    #[error("EXCLUDED_VIOLATION")]
    EXCLUDED_VIOLATION,
    #[error("SUBTREE_MINMAX")]
    SUBTREE_MINMAX,
    #[error("APPLICATION_VERIFICATION")]
    APPLICATION_VERIFICATION,
    #[error("UNSUPPORTED_CONSTRAINT_TYPE")]
    UNSUPPORTED_CONSTRAINT_TYPE,
    #[error("UNSUPPORTED_CONSTRAINT_SYNTAX")]
    UNSUPPORTED_CONSTRAINT_SYNTAX,
    #[error("UNSUPPORTED_NAME_SYNTAX")]
    UNSUPPORTED_NAME_SYNTAX,
    #[error("CRL_PATH_VALIDATION_ERROR")]
    CRL_PATH_VALIDATION_ERROR,
    #[error("SUITE_B_INVALID_VERSION")]
    SUITE_B_INVALID_VERSION,
    #[error("SUITE_B_INVALID_ALGORITHM")]
    SUITE_B_INVALID_ALGORITHM,
    #[error("SUITE_B_INVALID_CURVE")]
    SUITE_B_INVALID_CURVE,
    #[error("SUITE_B_INVALID_SIGNATURE_ALGORITHM")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Confirm the encoding: openssl x509 -in ca.pem -noout -text and look for minimum/maximum under Name Constraints
2. Regenerate the CA cert with plain subtrees (no min/max) and reissue the chain beneath it
3. Switch to a mainstream generation path (openssl, cfssl, step-ca) that omits these fields by default

Example fix

# before (ASN.1 template exposing min/max)
GeneralSubtree ::= SEQUENCE { base DNS:example.com, minimum 1, maximum 99 }

# after (conformant: fields omitted, i.e. zero)
GeneralSubtree ::= SEQUENCE { base DNS:example.com }

// Reject CA templates that set nameConstraints minimum/maximum before signing
import { execFileSync } from "node:child_process";
export function noSubtreeMinMax(caPem) {
  const txt = execFileSync("openssl", ["x509", "-noout", "-text"], { input: caPem }).toString();
  return !/(Name Constraints[\s\S]*?)\b(minimum|maximum)\b/.test(txt);
}

export function isSubtreeMinMax(e): e is Error & { code: "SUBTREE_MINMAX" } {
  return e instanceof Error && (e as any).code === "SUBTREE_MINMAX";
}

try {
  await fetch(url);
} catch (e) {
  if (e?.code === "SUBTREE_MINMAX") {
    // CA's nameConstraints carry nonzero min/max - regenerate the CA without them
    notifyCaOwners(url);
  } else throw e;
}

When it happens

Trigger: A CA cert's nameConstraints DER encodes base/min/max where min>0 or max is set. Some ASN.1 tooling lets you set these; X.509 conformant verifiers refuse.

Common situations: CAs generated through generic ASN.1 editors or exotic libraries that expose min/max; test CA templates ported from academic examples; rarely seen from commercial CAs.

Related errors

• UNSUPPORTED_CONSTRAINT_TYPE
• PERMITTED_VIOLATION
• EXCLUDED_VIOLATION
• UNSUPPORTED_CONSTRAINT_SYNTAX
• INVALID_EXTENSION

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/ea09108bdc3d3b50. Report an issue: GitHub.