oven-sh/bun · error · TypeError

UNSUPPORTED_CONSTRAINT_TYPE

UNSUPPORTED_CONSTRAINT_TYPE

Error message

UNSUPPORTED_CONSTRAINT_TYPE

What it means

CertError::UNSUPPORTED_CONSTRAINT_TYPE maps BoringSSL X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE (verify code 51). A nameConstraints extension contains a GeneralSubtree whose base is a name type the verifier cannot constrain - x400Address, ediPartyName, or registeredID. Message: "unsupported name constraint type".

Source

Thrown at src/http/error.rs:223

    #[error("INVALID_POLICY_EXTENSION")]
    INVALID_POLICY_EXTENSION,
    #[error("NO_EXPLICIT_POLICY")]
    NO_EXPLICIT_POLICY,
    #[error("DIFFERENT_CRL_SCOPE")]
    DIFFERENT_CRL_SCOPE,
    #[error("UNSUPPORTED_EXTENSION_FEATURE")]
    UNSUPPORTED_EXTENSION_FEATURE,
    #[error("UNNESTED_RESOURCE")]
    UNNESTED_RESOURCE,
    #[error("PERMITTED_VIOLATION")]
    PERMITTED_VIOLATION,
    #[error("EXCLUDED_VIOLATION")]
    EXCLUDED_VIOLATION,
    #[error("SUBTREE_MINMAX")]
    SUBTREE_MINMAX,
    #[error("APPLICATION_VERIFICATION")]
    APPLICATION_VERIFICATION,
    #[error("UNSUPPORTED_CONSTRAINT_TYPE")]
    UNSUPPORTED_CONSTRAINT_TYPE,
    #[error("UNSUPPORTED_CONSTRAINT_SYNTAX")]
    UNSUPPORTED_CONSTRAINT_SYNTAX,
    #[error("UNSUPPORTED_NAME_SYNTAX")]
    UNSUPPORTED_NAME_SYNTAX,
    #[error("CRL_PATH_VALIDATION_ERROR")]
    CRL_PATH_VALIDATION_ERROR,
    #[error("SUITE_B_INVALID_VERSION")]
    SUITE_B_INVALID_VERSION,
    #[error("SUITE_B_INVALID_ALGORITHM")]
    SUITE_B_INVALID_ALGORITHM,
    #[error("SUITE_B_INVALID_CURVE")]
    SUITE_B_INVALID_CURVE,
    #[error("SUITE_B_INVALID_SIGNATURE_ALGORITHM")]
    SUITE_B_INVALID_SIGNATURE_ALGORITHM,
    #[error("SUITE_B_LOS_NOT_ALLOWED")]
    SUITE_B_LOS_NOT_ALLOWED,
    #[error("SUITE_B_CANNOT_SIGN_P_384_WITH_P_256")]

View on GitHub (pinned to 8c5296ac45)

Solutions

  1. Inspect which type is used: openssl x509 -in ca.pem -noout -text (Name Constraints section)
  2. Reissue the CA constraining only supported types - DNS, IP, email, URI, directoryName
  3. Delete unused exotic constraints; keep the smallest constraint set that expresses the policy

Example fix

# before: constraint over an unsupported name type
nameConstraints = permitted;registeredID:1.2.3.4

# after: supported types only
nameConstraints = permitted;DNS:example.com, excluded;IP:10.0.0.0/8
Defensive patterns

Strategy: try-catch

Validate before calling

// Lint CA nameConstraints for unsupported GeneralName types before deployment
import { execFileSync } from "node:child_process";
export function constraintsUseSupportedTypes(caPem) {
  const txt = execFileSync("openssl", ["x509", "-noout", "-text"], { input: caPem }).toString();
  const nc = txt.split("X509v3 Name Constraints:")[1] ?? "";
  return !/(X400|EDI Party|Registered ID|othername)/i.test(nc);
}

Type guard

export function isUnsupportedConstraintType(e): e is Error & { code: "UNSUPPORTED_CONSTRAINT_TYPE" } {
  return e instanceof Error && (e as any).code === "UNSUPPORTED_CONSTRAINT_TYPE";
}

Try / catch

try {
  await fetch(url);
} catch (e) {
  if (e?.code === "UNSUPPORTED_CONSTRAINT_TYPE") {
    // CA constrains an exotic name type - reissue with DNS/IP/email/URI/dirName only
    flagCaConfig(url, "exotic-constraint-type");
  } else throw e;
}

Prevention

When it happens

Trigger: A CA encodes nameConstraints over an exotic GeneralName type; BoringSSL's path validation refuses the whole constraint set rather than ignoring it.

Common situations: Legacy EDI/X.400-era PKIs; ASN.1 generation tools that happily emit every name type; constraints copied from standards examples into real CA configs.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/9153f05a44a13a04. Report an issue: GitHub.