oven-sh/bun · error · TypeError

UNSUPPORTED_CONSTRAINT_SYNTAX

UNSUPPORTED_CONSTRAINT_SYNTAX

Error message

UNSUPPORTED_CONSTRAINT_SYNTAX

What it means

CertError::UNSUPPORTED_CONSTRAINT_SYNTAX maps BoringSSL X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX (verify code 52). The contents of a nameConstraints subtree are syntactically invalid or unsupported for its type - e.g. a URI constraint carrying a full host instead of a bare scheme, an email constraint with a malformed domain, or a DNS constraint that is not a valid domain. Message: "unsupported or invalid name constraint syntax".

Source

Thrown at src/http/error.rs:225

    #[error("NO_EXPLICIT_POLICY")]
    NO_EXPLICIT_POLICY,
    #[error("DIFFERENT_CRL_SCOPE")]
    DIFFERENT_CRL_SCOPE,
    #[error("UNSUPPORTED_EXTENSION_FEATURE")]
    UNSUPPORTED_EXTENSION_FEATURE,
    #[error("UNNESTED_RESOURCE")]
    UNNESTED_RESOURCE,
    #[error("PERMITTED_VIOLATION")]
    PERMITTED_VIOLATION,
    #[error("EXCLUDED_VIOLATION")]
    EXCLUDED_VIOLATION,
    #[error("SUBTREE_MINMAX")]
    SUBTREE_MINMAX,
    #[error("APPLICATION_VERIFICATION")]
    APPLICATION_VERIFICATION,
    #[error("UNSUPPORTED_CONSTRAINT_TYPE")]
    UNSUPPORTED_CONSTRAINT_TYPE,
    #[error("UNSUPPORTED_CONSTRAINT_SYNTAX")]
    UNSUPPORTED_CONSTRAINT_SYNTAX,
    #[error("UNSUPPORTED_NAME_SYNTAX")]
    UNSUPPORTED_NAME_SYNTAX,
    #[error("CRL_PATH_VALIDATION_ERROR")]
    CRL_PATH_VALIDATION_ERROR,
    #[error("SUITE_B_INVALID_VERSION")]
    SUITE_B_INVALID_VERSION,
    #[error("SUITE_B_INVALID_ALGORITHM")]
    SUITE_B_INVALID_ALGORITHM,
    #[error("SUITE_B_INVALID_CURVE")]
    SUITE_B_INVALID_CURVE,
    #[error("SUITE_B_INVALID_SIGNATURE_ALGORITHM")]
    SUITE_B_INVALID_SIGNATURE_ALGORITHM,
    #[error("SUITE_B_LOS_NOT_ALLOWED")]
    SUITE_B_LOS_NOT_ALLOWED,
    #[error("SUITE_B_CANNOT_SIGN_P_384_WITH_P_256")]
    SUITE_B_CANNOT_SIGN_P_384_WITH_P_256,
    #[error("HOSTNAME_MISMATCH")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Dump and eyeball the constraint values: openssl x509 -in ca.pem -noout -text
2. Fix per RFC 5280: URI constraints = scheme only ('https'), DNS = bare domain suffix ('example.com'), email = domain after '@' or full address
3. Reissue the CA with corrected constraints, then reissue/re-validate the chain

Example fix

# before: URI constraint as a full URL (invalid syntax)
nameConstraints = permitted;URI:https://example.com/path

# after: scheme-only URI constraint
nameConstraints = permitted;URI:https

// Validate constraint values against RFC 5280 per-type syntax before signing the CA
export function constraintSyntaxOk(type, value) {
  switch (type) {
    case "URI": return /^[a-z][a-z0-9+.-]*$/.test(value);      // scheme only
    case "DNS": return /^[a-z0-9.-]+$/i.test(value) && !value.startsWith(".");
    case "email": return /@/.test(value) || /^[a-z0-9.-]+$/i.test(value);
    case "IP": return value.includes("/");
    default: return false;
  }
}

export function isUnsupportedConstraintSyntax(e): e is Error & { code: "UNSUPPORTED_CONSTRAINT_SYNTAX" } {
  return e instanceof Error && (e as any).code === "UNSUPPORTED_CONSTRAINT_SYNTAX";
}

try {
  await fetch(url);
} catch (e) {
  if (e?.code === "UNSUPPORTED_CONSTRAINT_SYNTAX") {
    // a name-constraint value violates its type's syntax (e.g. URI constraint not scheme-only)
    sendCaFix("constraint-syntax", url);
  } else throw e;
}

When it happens

Trigger: CA issues nameConstraints where the value does not follow RFC 5280's per-type syntax rules; the verifier parses the extension and rejects the subtree encoding.

Common situations: URI constraints written as 'https://example.com' instead of scheme-only 'https'; DNS constraints containing wildcards, leading dots, or spaces; email constraints missing the '@' domain form; template typos in CA tooling.

Related errors

• PERMITTED_VIOLATION
• EXCLUDED_VIOLATION
• SUBTREE_MINMAX
• UNSUPPORTED_CONSTRAINT_TYPE
• NO_EXPLICIT_POLICY

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/cefcfe6c5ef82a6a. Report an issue: GitHub.