v2rayA/v2rayA · error

bad certificate: no names found

Error message

bad certificate: no names found

What it means

GetCertInfo collects SAN entries from the parsed certificate: DNSNames plus IPAddresses. If a certificate has neither any DNS SAN nor any IP SAN, the function refuses to proceed and returns "bad certificate: no names found". Certificates with only Common Name (no SAN) are rejected.

Source

Thrown at service/common/crypto.go:141

func GetCertInfo(crt string) (names []string, err error) {
	b, err := os.ReadFile(crt)
	if err != nil {
		return nil, err
	}
	p, _ := pem.Decode(b)
	if p == nil {
		return nil, fmt.Errorf("bad certificate")
	}
	cert, err := x509.ParseCertificate(p.Bytes)
	if err != nil {
		return nil, fmt.Errorf("bad certificate: %w", err)
	}
	names = append(names, cert.DNSNames...)
	for _, ip := range cert.IPAddresses {
		names = append(names, ip.String())
	}
	if len(names) <= 0 {
		return nil, fmt.Errorf("bad certificate: no names found")
	}
	return names, nil
}

View on GitHub (pinned to 71e5442fc5)

Solutions

1. Regenerate the certificate including SAN entries (openssl req -addext "subjectAltName=DNS:example.com")
2. If the cert relies on CN only, re-issue it with SANs — modern TLS clients ignore CN
3. Confirm the intended cert was fetched, not a placeholder/CA cert

Example fix

// before
openssl req -x509 -newkey rsa:2048 -keyout k.pem -out c.pem -subj "/CN=myhost"
// after
openssl req -x509 -newkey rsa:2048 -keyout k.pem -out c.pem -subj "/CN=myhost" -addext "subjectAltName=DNS:myhost,IP:127.0.0.1"

block, _ := pem.Decode(raw)
if block != nil {
    if c, err := x509.ParseCertificate(block.Bytes); err == nil {
        if len(c.DNSNames) == 0 && len(c.IPAddresses) == 0 {
            return fmt.Errorf("certificate has no SAN entries")
        }
    }
}

func certHasSANs(raw []byte) bool {
    p, _ := pem.Decode(raw)
    if p == nil { return false }
    c, err := x509.ParseCertificate(p.Bytes)
    return err == nil && (len(c.DNSNames) > 0 || len(c.IPAddresses) > 0)
}

if err != nil {
    if strings.Contains(err.Error(), "no names found") {
        // re-issue cert with SANs
    }
    return err
}

When it happens

Trigger: Calling GetCertInfo on a certificate whose SAN extension contains no dNSName and no iPAddress entries (names list empty after appending DNSNames and IP addresses).

Common situations: Old/self-signed certificates that only set CN without a SAN extension; hand-rolled certificates generated without -extfile SAN entries; internal CA certificates missing SANs.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• bad certificate
• bad certificate: %w
• failed to create anytls stream
• unrecognized peer certificate pin: %q
• hysteria2: %w

AI-assisted analysis of v2rayA/v2rayA@71e5442fc5 (2026-09-05). Data as JSON: /api/errors/7dc336ddefc08499. Report an issue: GitHub.