owasp-amass/amass · error

failed to cast the TLSCertificate asset

Error message

failed to cast the TLSCertificate asset

What it means

The horizontals TLS certificate handler's check() method is invoked for every event it subscribes to, and asserts e.Entity.Asset to *oamcert.TLSCertificate. When the event carries any other asset type, the assertion fails and this error is returned, aborting processing of that event. It means the plugin's event filter routed a non-TLS-certificate entity into the handler.

Source

Thrown at engine/plugins/horizontals/tls_cert.go:31

	dbt "github.com/owasp-amass/asset-db/types"
	oam "github.com/owasp-amass/open-asset-model"
	oamcert "github.com/owasp-amass/open-asset-model/certificate"
	oamdns "github.com/owasp-amass/open-asset-model/dns"
)

type horTlsCert struct {
	name   string
	plugin *horizPlugin
}

func (h *horTlsCert) Name() string {
	return h.name
}

func (h *horTlsCert) check(e *et.Event) error {
	c, ok := e.Entity.Asset.(*oamcert.TLSCertificate)
	if !ok {
		return errors.New("failed to cast the TLSCertificate asset")
	}

	// check if scope expansion is allowed
	if e.Session.Config().Rigid {
		return nil
	}

	if orgs, err := h.lookup(e.Session, e.Entity); err == nil && len(orgs) > 0 {
		h.process(e, c, orgs)
	}
	return nil
}

func (h *horTlsCert) lookup(sess et.Session, tlsent *dbt.Entity) ([]*dbt.Entity, error) {
	cr, err := h.plugin.getContactRecord(sess, tlsent, "subject_contact")
	if err != nil {
		return nil, errors.New("failed to obtain the subject contact record")
	}

View on GitHub (pinned to 79299dce87)

Solutions

1. Check the event type in check(): if _, ok := e.Entity.Asset.(*oamcert.TLSCertificate); !ok { return nil } — i.e. treat mismatch as 'not for me' rather than an error
2. Narrow the plugin's event subscription so only TLSCertificate events invoke check()
3. Audit upstream producers of TLS events to confirm they always set Asset to *oamcert.TLSCertificate

Example fix

// before
c, ok := e.Entity.Asset.(*oamcert.TLSCertificate)
if !ok {
	return errors.New("failed to cast the TLSCertificate asset")
}

// after
c, ok := e.Entity.Asset.(*oamcert.TLSCertificate)
if !ok {
	return nil
}

if _, ok := e.Entity.Asset.(*oamcert.TLSCertificate); !ok {
	return nil
}

func asTLSCert(e *et.Event) (*oamcert.TLSCertificate, bool) {
	c, ok := e.Entity.Asset.(*oamcert.TLSCertificate)
	return c, ok
}

if err := h.check(ev); err != nil {
	if strings.Contains(err.Error(), "failed to cast") {
		continue // unrelated asset type
	}
	log.Error(err)
}

When it happens

Trigger: An event whose Entity.Asset is not *oamcert.TLSCertificate reaches horTlsCert.check — typically because the event subscription/topic matches multiple asset types or a new TLS-related relation was added without filtering.

Common situations: Custom event handlers subscribing to broad output topics; middleware emitting TLS entities with a different asset struct; library version changes to the oamcert.TLSCertificate type.

Understand the failure class

Background: Type mismatch errors: IllegalArgumentException, TypeError and type guards across 150 open-source libraries — this error's family across 150 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to cast the DomainRecord
• failed to cast the IPNetRecord
• failed to extract the IPAddress asset
• failed to extract the Service asset
• failed to extract the FQDN asset

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/cfc8e6a32688f8d7. Report an issue: GitHub.