java - Bouncy Castle GeneralName creation failing with "argument type mismatch" in CFML - Stack Overflow

I'm trying to generate a Certificate Signing Request (CSR) using Bouncy Castle in CFML/Lucee. The CSR needs to include Subject Alternative Names (SANs) for both DNS names and IP addresses. However, I'm getting an argument type mismatch error when trying to create GeneralName objects. Here's my current approach:

// Add Subject Alternative Names
var vector = createObject("java", "org.bouncycastle.asn1.ASN1EncodableVector").init();

// Add FQDN as DNS name
var dnsType = javacast("int", 2); // DNS type is 2
var GeneralName = createObject("java", "org.bouncycastle.asn1.x509.GeneralName");
var DERIA5String = createObject("java", "org.bouncycastle.asn1.DERIA5String");

// Convert FQDN to ASN1String
var fqdnStr = DERIA5String.getInstance(arguments.fqdn);
vector.add(GeneralName.init(dnsType, fqdnStr));

// Add IP address
if (len(trim(arguments.ipAddress))) {
    var inetAddress = createObject("java", "java.InetAddress").getByName(arguments.ipAddress);
    var DEROctetString = createObject("java", "org.bouncycastle.asn1.DEROctetString");
    var ipStr = DEROctetString.getInstance(inetAddress.getAddress());
    vector.add(GeneralName.init(javacast("int", 7), ipStr)); // IP type is 7
}

var derSequence = createObject("java", "org.bouncycastle.asn1.DERSequence").init(vector);
var generalNames = createObject("java", "org.bouncycastle.asn1.x509.GeneralNames").init(derSequence);

Error:

[ERROR] 2025-02-03 14:50:36 modules_app.dod-csr-generator.models.CertificateGenerator Error generating CSR: argument type mismatch | ExtraInfo: 
    ErrorType = java.lang.IllegalArgumentException Message = argument type mismatch StackTrace = lucee.runtime.exp.NativeException: argument type mismatch
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance

I've tried several approaches including:

Using GeneralName.dNSName and GeneralName.iPAddress constants Directly creating ASN1 strings Using different constructor patterns Using DERSequence with ASN1EncodableVector Using different javacast types

The CSR itself works when I don't include SANs, but I need to support both DNS names and IP addresses in the SAN extension. I'm using Bouncy Castle 1.76 with Lucee 5.x. Any insights on the correct way to create GeneralName objects in CFML would be appreciated.

I'm trying to generate a Certificate Signing Request (CSR) using Bouncy Castle in CFML/Lucee. The CSR needs to include Subject Alternative Names (SANs) for both DNS names and IP addresses. However, I'm getting an argument type mismatch error when trying to create GeneralName objects. Here's my current approach:

// Add Subject Alternative Names
var vector = createObject("java", "org.bouncycastle.asn1.ASN1EncodableVector").init();

// Add FQDN as DNS name
var dnsType = javacast("int", 2); // DNS type is 2
var GeneralName = createObject("java", "org.bouncycastle.asn1.x509.GeneralName");
var DERIA5String = createObject("java", "org.bouncycastle.asn1.DERIA5String");

// Convert FQDN to ASN1String
var fqdnStr = DERIA5String.getInstance(arguments.fqdn);
vector.add(GeneralName.init(dnsType, fqdnStr));

// Add IP address
if (len(trim(arguments.ipAddress))) {
    var inetAddress = createObject("java", "java.net.InetAddress").getByName(arguments.ipAddress);
    var DEROctetString = createObject("java", "org.bouncycastle.asn1.DEROctetString");
    var ipStr = DEROctetString.getInstance(inetAddress.getAddress());
    vector.add(GeneralName.init(javacast("int", 7), ipStr)); // IP type is 7
}

var derSequence = createObject("java", "org.bouncycastle.asn1.DERSequence").init(vector);
var generalNames = createObject("java", "org.bouncycastle.asn1.x509.GeneralNames").init(derSequence);

Error:

[ERROR] 2025-02-03 14:50:36 modules_app.dod-csr-generator.models.CertificateGenerator Error generating CSR: argument type mismatch | ExtraInfo: 
    ErrorType = java.lang.IllegalArgumentException Message = argument type mismatch StackTrace = lucee.runtime.exp.NativeException: argument type mismatch
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance

I've tried several approaches including:

Using GeneralName.dNSName and GeneralName.iPAddress constants Directly creating ASN1 strings Using different constructor patterns Using DERSequence with ASN1EncodableVector Using different javacast types

The CSR itself works when I don't include SANs, but I need to support both DNS names and IP addresses in the SAN extension. I'm using Bouncy Castle 1.76 with Lucee 5.x. Any insights on the correct way to create GeneralName objects in CFML would be appreciated.

• java
• bouncycastle
• x509
• cfml
• lucee

Share Improve this question Follow edited Feb 3 at 16:22 President James K. Polk 42.1k2929 gold badges109109 silver badges145145 bronze badges asked Feb 3 at 2:20 George MurphyGeorge Murphy 1,10722 gold badges1111 silver badges2020 bronze badges 5

• include the complete exception stacktrace. – President James K. Polk Commented Feb 3 at 5:20
• ``` [ERROR] 2025-02-03 14:50:36 modules_app.dod-csr-generator.models.CertificateGenerator Error generating CSR: argument type mismatch | ExtraInfo: ErrorType = java.lang.IllegalArgumentException Message = argument type mismatch StackTrace = lucee.runtime.exp.NativeException: argument type mismatch at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance – George Murphy Commented Feb 3 at 14:58
• Thanks, George. That has less information than I had hoped. Do you have an idea which line of your code above is throwing the Exception? – President James K. Polk Commented Feb 3 at 16:23
• James, thanks. How can I give you the entire stack trace? It is quite long. It seems to be the 2 lines after the if statement. – George Murphy Commented Feb 4 at 21:04
• Just edit your question and add it there. – President James K. Polk Commented Feb 4 at 22:18

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 2

(Using Java syntax for code)

I expect the problem is here:

DEROctetString.getInstance(inetAddress.getAddress())

That tries to parse the IP address octets, but they only need to be wrapped:

new DEROctetString(inetAddress.getAddress())

Actually it may be simpler to pass the IP address String directly to a different GeneralName constructor:

new GeneralName(GeneralName.iPAddress, arguments.ipAddress)