apereo/cas · error · IllegalArgumentException

Unknown CRL reason code.

Error message

Unknown CRL reason code.

What it means

RevocationReason.fromCode() in RevokedCertificateException maps a numeric X.509 CRL reason code (RFC 5280 enumerated reasons) to its named constant by indexing a reasons array. A code outside the array range throws IllegalArgumentException('Unknown CRL reason code.').

Solutions

1. Validate the code is within the RFC 5280 reason range before calling fromCode() and fall back to 'unspecified' otherwise.
2. Upgrade CAS so the reasons enum covers all codes your PKI can emit.
3. Translate raw CRL codes yourself with a bounds-checked wrapper instead of calling fromCode() unchecked.
4. Inspect the actual code with: openssl crl -in crl.pem -noout -text.

Example fix

// before
RevocationReason reason = RevocationReason.fromCode(rawCode);
// after
RevocationReason reason = (rawCode >= 0 && rawCode <= 10)
    ? RevocationReason.fromCode(rawCode)
    : RevocationReason.UNSPECIFIED;

boolean isKnownCrlReasonCode(int code) { return code >= 0 && code <= 10; } // RFC 5280 enumerated reasons

Integer normalizeReason(Integer code) { return (code != null && code >= 0 && code <= 10) ? code : Integer.valueOf(0); /* unspecified */ }

try {
    reason = RevocationReason.fromCode(code);
} catch (IllegalArgumentException e) {
    reason = RevocationReason.UNSPECIFIED;
}

When it happens

Trigger: fromCode() is called with a reason code that matches no entry in the reasons array — negative codes, codes beyond the array length, or proprietary/unrecognized codes taken raw from a CRL or upstream revocation checker.

Common situations: Custom revocation-checking code passes raw integers from third-party CRL formats; off-by-one translation of RFC reason codes (0=unspecified ... 10=removeFromCRL); older CAS versions encountering reason codes not present in the enum.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Failed to establish a connection ldap and search.
• CRL data is not available for
• CRL data expired on [ ]
• All CRL entries have been revoked. Rejecting the first entry
• Could not decode provided CRL file

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/e2f2bccb0d8ee363. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/revocation/RevokedCertificateException.java:152

         * The AA compromise.
         */
        AACompromise;

        /**
         * Convert code to reason.
         *
         * @param code the code
         * @return the reason
         */
        public static Reason fromCode(final int code) {
            val reasons = Reason.values();

            for (var i = 0; i < reasons.length; i++) {
                if (i == code) {
                    return reasons[i];
                }
            }
            throw new IllegalArgumentException("Unknown CRL reason code.");
        }
    }
}

View on GitHub (pinned to e7288fc434)