owasp-amass/amass · warning

failed to obtain the subject organizations

Error message

failed to obtain the subject organizations

What it means

After obtaining the subject contact record, horTlsCert.lookup calls getContactRecordOrganizations(sess, cr) to resolve the organizations linked to that contact; on any error this generic message replaces the cause. It means the organizations for the certificate's subject contact could not be retrieved from the graph.

Source

Thrown at engine/plugins/horizontals/tls_cert.go:53

	if e.Session.Config().Rigid {
		return nil
	}

	if orgs, err := h.lookup(e.Session, e.Entity); err == nil && len(orgs) > 0 {
		h.process(e, c, orgs)
	}
	return nil
}

func (h *horTlsCert) lookup(sess et.Session, tlsent *dbt.Entity) ([]*dbt.Entity, error) {
	cr, err := h.plugin.getContactRecord(sess, tlsent, "subject_contact")
	if err != nil {
		return nil, errors.New("failed to obtain the subject contact record")
	}

	orgs, err := h.plugin.getContactRecordOrganizations(sess, cr)
	if err != nil {
		return nil, errors.New("failed to obtain the subject organizations")
	}

	return orgs, nil
}

func (h *horTlsCert) process(e *et.Event, c *oamcert.TLSCertificate, orgs []*dbt.Entity) {
	// check if the TLS certificate subject common name is in scope
	if _, conf := e.Session.Scope().IsAssetInScope(&oamdns.FQDN{Name: c.SubjectCommonName}, 0); conf > 0 {
		return
	}

	var found bool
	for _, o := range orgs {
		if h.plugin.isEntityInScope(e.Session, o) {
			found = true
			break
		}
	}

View on GitHub (pinned to 79299dce87)

Solutions

1. Wrap the original error: fmt.Errorf("failed to obtain the subject organizations: %w", err)
2. Check that data sources creating Organization entities and their relations are enabled
3. Treat missing organizations as non-fatal: return (nil, nil) so the certificate is skipped without failing the event

Example fix

// before
orgs, err := h.plugin.getContactRecordOrganizations(sess, cr)
if err != nil {
	return nil, errors.New("failed to obtain the subject organizations")
}

// after
orgs, err := h.plugin.getContactRecordOrganizations(sess, cr)
if err != nil {
	return nil, fmt.Errorf("failed to obtain the subject organizations: %w", err)
}

orgs, err := h.plugin.getContactRecordOrganizations(sess, cr)
if err != nil || len(orgs) == 0 {
	return nil, nil // nothing to expand; skip
}

orgs, err := h.lookup(sess, tlsent)
if err != nil {
	log.WithError(err).Debug("subject organizations unavailable; skipping")
	return nil
}

When it happens

Trigger: The subject contact record exists but has no organization relation, or getContactRecordOrganizations' DB query fails; the original error is masked by errors.New here.

Common situations: Contact records created without linked Organization entities by certain data sources; graph DB connectivity issues during long scans; TTL cleanup removing organization relations mid-scan.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

• failed to obtain the subject contact record
• zero locations found
• failed to extract the locations
• failed to cast the DomainRecord
• failed to cast the IPNetRecord

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/eae400699239f3cb. Report an issue: GitHub.