oven-sh/bun · error · TypeError

SUITE_B_INVALID_CURVE

SUITE_B_INVALID_CURVE

Error message

SUITE_B_INVALID_CURVE

What it means

CertError::SUITE_B_INVALID_CURVE maps BoringSSL X509_V_ERR_SUITE_B_INVALID_CURVE (verify code 58). Suite B permits only NIST P-256 and P-384; a chain certificate's EC key uses a different curve (P-521, brainpool, secp256k1...). Message: "Suite B: invalid ECC curve".

Source

Thrown at src/http/error.rs:235

    #[error("EXCLUDED_VIOLATION")]
    EXCLUDED_VIOLATION,
    #[error("SUBTREE_MINMAX")]
    SUBTREE_MINMAX,
    #[error("APPLICATION_VERIFICATION")]
    APPLICATION_VERIFICATION,
    #[error("UNSUPPORTED_CONSTRAINT_TYPE")]
    UNSUPPORTED_CONSTRAINT_TYPE,
    #[error("UNSUPPORTED_CONSTRAINT_SYNTAX")]
    UNSUPPORTED_CONSTRAINT_SYNTAX,
    #[error("UNSUPPORTED_NAME_SYNTAX")]
    UNSUPPORTED_NAME_SYNTAX,
    #[error("CRL_PATH_VALIDATION_ERROR")]
    CRL_PATH_VALIDATION_ERROR,
    #[error("SUITE_B_INVALID_VERSION")]
    SUITE_B_INVALID_VERSION,
    #[error("SUITE_B_INVALID_ALGORITHM")]
    SUITE_B_INVALID_ALGORITHM,
    #[error("SUITE_B_INVALID_CURVE")]
    SUITE_B_INVALID_CURVE,
    #[error("SUITE_B_INVALID_SIGNATURE_ALGORITHM")]
    SUITE_B_INVALID_SIGNATURE_ALGORITHM,
    #[error("SUITE_B_LOS_NOT_ALLOWED")]
    SUITE_B_LOS_NOT_ALLOWED,
    #[error("SUITE_B_CANNOT_SIGN_P_384_WITH_P_256")]
    SUITE_B_CANNOT_SIGN_P_384_WITH_P_256,
    #[error("HOSTNAME_MISMATCH")]
    HOSTNAME_MISMATCH,
    #[error("EMAIL_MISMATCH")]
    EMAIL_MISMATCH,
    #[error("IP_ADDRESS_MISMATCH")]
    IP_ADDRESS_MISMATCH,
    #[error("INVALID_CALL")]
    INVALID_CALL,
    #[error("STORE_LOOKUP")]
    STORE_LOOKUP,
    #[error("NAME_CONSTRAINTS_WITHOUT_SANS")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Check curves in the chain: openssl x509 -noout -text | grep 'ASN1 OID' on each cert's public key
2. Reissue the offending certs on P-256 (128-bit LOS) or P-384 (192-bit LOS)
3. If the non-Suite-B curve is a hard requirement, remove Suite B flags from the verifier - the two are mutually exclusive

Example fix

# before
openssl ecparam -name secp256k1 -genkey -out key.pem

# after: Suite B curve
openssl ecparam -name prime256v1 -genkey -out key.pem

// Assert every chain cert's curve is P-256/P-384 before Suite B clients connect
import tls from "node:tls";
import { X509Certificate } from "node:crypto";
export function chainCurvesSuiteB(host, port = 443) {
  return new Promise((resolve, reject) => {
    const s = tls.connect({ host, port, servername: host, rejectUnauthorized: false }, () => {
      let c = s.getPeerCertificate(true), ok = true;
      do {
        const k = new X509Certificate(c.raw).keyObject;
        ok = ok && k.asymmetricKeyType === "ec" && ["secp256k1"].every(() => true) && !["p521", "brainpool"].some(() => false);
        // precise check via JWK crv:
        const { crv } = k.export({ format: "jwk" });
        ok = ok && (crv === "P-256" || crv === "P-384");
      } while (c.issuerCertificate && (c = c.issuerCertificate) && !Object.is(c, s.getPeerCertificate(true)));
      s.end(); resolve(ok);
    });
    s.on("error", reject);
  });
}

export function isSuiteBInvalidCurve(e): e is Error & { code: "SUITE_B_INVALID_CURVE" } {
  return e instanceof Error && (e as any).code === "SUITE_B_INVALID_CURVE";
}

try {
  await fetch(url);
} catch (e) {
  if (e?.code === "SUITE_B_INVALID_CURVE") {
    // a non-P256/P384 curve is in the chain - reissue on a Suite B curve or drop the flags
    fixCurveProfile(url);
  } else throw e;
}

When it happens

Trigger: Suite B verification enabled and an EC cert in the chain names a non-Suite-B curve in its public key parameters.

Common situations: Blockchain-adjacent infra reusing secp256k1 certs; European deployments with brainpool curves hitting a Suite B verifier; experimentation with P-521 for 'more security' against a Suite B profile.

Related errors

• SUITE_B_INVALID_ALGORITHM
• SUITE_B_INVALID_SIGNATURE_ALGORITHM
• SUITE_B_LOS_NOT_ALLOWED
• SUITE_B_CANNOT_SIGN_P_384_WITH_P_256
• SUITE_B_INVALID_VERSION

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/9fa40e1cb09517dd. Report an issue: GitHub.