oven-sh/bun · error · TypeError

UNSUPPORTED_NAME_SYNTAX

UNSUPPORTED_NAME_SYNTAX

Error message

UNSUPPORTED_NAME_SYNTAX

What it means

CertError::UNSUPPORTED_NAME_SYNTAX maps BoringSSL X509_V_ERR_UNSUPPORTED_NAME_SYNTAX (verify code 53). A name inside the certificate (SAN entry, subject DN, or a name being matched) has invalid or unsupported syntax for its GeneralName type - e.g. a directoryName whose DN violates encoding rules, a URI SAN that is not a valid URI, or an email SAN with bad syntax. Message: "unsupported or invalid name syntax".

Source

Thrown at src/http/error.rs:227

    #[error("DIFFERENT_CRL_SCOPE")]
    DIFFERENT_CRL_SCOPE,
    #[error("UNSUPPORTED_EXTENSION_FEATURE")]
    UNSUPPORTED_EXTENSION_FEATURE,
    #[error("UNNESTED_RESOURCE")]
    UNNESTED_RESOURCE,
    #[error("PERMITTED_VIOLATION")]
    PERMITTED_VIOLATION,
    #[error("EXCLUDED_VIOLATION")]
    EXCLUDED_VIOLATION,
    #[error("SUBTREE_MINMAX")]
    SUBTREE_MINMAX,
    #[error("APPLICATION_VERIFICATION")]
    APPLICATION_VERIFICATION,
    #[error("UNSUPPORTED_CONSTRAINT_TYPE")]
    UNSUPPORTED_CONSTRAINT_TYPE,
    #[error("UNSUPPORTED_CONSTRAINT_SYNTAX")]
    UNSUPPORTED_CONSTRAINT_SYNTAX,
    #[error("UNSUPPORTED_NAME_SYNTAX")]
    UNSUPPORTED_NAME_SYNTAX,
    #[error("CRL_PATH_VALIDATION_ERROR")]
    CRL_PATH_VALIDATION_ERROR,
    #[error("SUITE_B_INVALID_VERSION")]
    SUITE_B_INVALID_VERSION,
    #[error("SUITE_B_INVALID_ALGORITHM")]
    SUITE_B_INVALID_ALGORITHM,
    #[error("SUITE_B_INVALID_CURVE")]
    SUITE_B_INVALID_CURVE,
    #[error("SUITE_B_INVALID_SIGNATURE_ALGORITHM")]
    SUITE_B_INVALID_SIGNATURE_ALGORITHM,
    #[error("SUITE_B_LOS_NOT_ALLOWED")]
    SUITE_B_LOS_NOT_ALLOWED,
    #[error("SUITE_B_CANNOT_SIGN_P_384_WITH_P_256")]
    SUITE_B_CANNOT_SIGN_P_384_WITH_P_256,
    #[error("HOSTNAME_MISMATCH")]
    HOSTNAME_MISMATCH,
    #[error("EMAIL_MISMATCH")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Inspect all names: openssl x509 -in cert.pem -noout -text (Subject Alternative Name + Subject)
2. Reissue with clean values: no whitespace in DNS SANs, scheme-present URIs, properly escaped DN components (commas as \,)
3. Check the issuer's nameConstraints too - the rejected name may be in the CA, not the leaf

Example fix

# before: bad SAN syntax
subjectAltName = DNS:"example.com ", URI:example.com/resource

# after: valid syntax
subjectAltName = DNS:example.com, URI:https://example.com/resource

// Lint SAN entries and subject DN syntax before the cert is trusted/issued
export function namesSyntaxOk(sans /* {type,value}[] */) {
  return sans.every(({ type, value }) => {
    const v = value.trim();
    if (v !== value) return false;                 // no surrounding whitespace
    if (type === "DNS") return /^[a-z0-9*.-]+$/i.test(v);
    if (type === "URI") return /^[a-z][a-z0-9+.-]*:/.test(v); // has a scheme
    if (type === "IP") return /^[\d.:a-f]+$/i.test(v);
    return true;
  });
}

export function isUnsupportedNameSyntax(e): e is Error & { code: "UNSUPPORTED_NAME_SYNTAX" } {
  return e instanceof Error && (e as any).code === "UNSUPPORTED_NAME_SYNTAX";
}

try {
  await fetch(url);
} catch (e) {
  if (e?.code === "UNSUPPORTED_NAME_SYNTAX") {
    // some SAN/DN in the chain has invalid syntax for its type - reissue cleanly
    requestCertReroll(new URL(url).hostname);
  } else throw e;
}

When it happens

Trigger: Chain validation reaches a name it must process (because constraints apply or it is the reference name) and its syntax fails the per-type parser; common with malformed directoryName SANs and malformed URI/email SANs.

Common situations: Certificates minted by scripts with unescaped special characters in DNs; SANs like 'DNS:example.com ' (trailing whitespace) or URI entries without a scheme; certs accepted by lax verifiers then rejected when path processing actually reads the name.

Related errors

• INVALID_EXTENSION
• INVALID_POLICY_EXTENSION
• PERMITTED_VIOLATION
• EXCLUDED_VIOLATION
• SUBTREE_MINMAX

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/95cd034977616bce. Report an issue: GitHub.