apereo/cas · warning

Unable to fetch [ ]

Error message

Unable to fetch [{}]

What it means

ResourceCRLFetcher.fetch failed to obtain an X509CRL from the given Spring Resource (file, HTTP, LDAP URL, etc.). The batch fetch returned an empty result, so this warning is logged and null is returned, causing CRL-based revocation checking to have no certificate revocation list to work with.

Solutions

1. Verify the CRL resource URI is reachable and correct: open the file/URL directly (curl or browser) and confirm it downloads a valid CRL.
2. Check file permissions and existence if the resource is a local file path; correct the path in the X509 revocation configuration.
3. Inspect earlier log lines for the underlying cause logged by the batch fetch, and fix the connection/parse error reported there.
4. Configure a fallback or cached CRL store and ensure the revocation checker can proceed when a single CRL is unavailable.

Example fix

// before
cas.authn.x509.revocation.crl-resources=file:///etc/cas/crls/old-ca.crl
// after (correct, existing path)
cas.authn.x509.revocation.crl-resources=file:///etc/cas/crls/ca.crl

// Pre-flight check the CRL resource before handing it to the fetcher:
val resource = new UrlResource(crlUri);
if (!resource.exists()) {
    throw new IllegalStateException("CRL resource not reachable: " + crlUri);
}
return resource;

try {
    X509CRL crl = fetcher.fetch(crlResource);
    if (crl == null) {
        logger.warn("CRL unavailable for {}; using cached CRL if present", crlResource);
        return cachedCrl; // fallback
    }
    return crl;
} catch (Exception e) {
    logger.error("Failed to fetch CRL from {}", crlResource, e);
    return cachedCrl;
}

When it happens

Trigger: Calling fetch(Resource) (or the batch fetch(Collection<Resource>)) with a resource whose CRL cannot be loaded: the file/URL is unreachable, the resource does not exist, the remote server returns an error, or the fetched data cannot be parsed as a CRL.

Common situations: CRL distribution point URL points to a file path or HTTP endpoint that moved or is down; cron-based CRL refresh caches a stale/empty download; wrong path in cas.authn.x509 revocation CRL resource settings; firewall blocks the CRL endpoint.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Could not decode provided CRL file
• Failed to establish a connection ldap and search.
• Unknown CRL reason code.
• Found certificate attribute
• CRL data is not available for

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/7a5732b20fd14a1d. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/ResourceCRLFetcher.java:61

    }

    @Override
    public X509CRL fetch(final URI crl) throws Exception {
        return fetch(crl.toURL());
    }

    @Override
    public X509CRL fetch(final URL crl) throws Exception {
        return fetch(new UrlResource(crl));
    }

    @Override
    public X509CRL fetch(final Resource crl) throws Exception {
        val results = fetch(CollectionUtils.wrap(crl));
        if (!results.isEmpty()) {
            return results.iterator().next();
        }
        LOGGER.warn("Unable to fetch [{}]", crl);
        return null;
    }
}

View on GitHub (pinned to e7288fc434)