{"record":{"id":"3df7424161d401b9","repo":"hyperledger/fabric","slug":"could-not-parse-revocationlist","errorCode":null,"errorMessage":"could not parse RevocationList","messagePattern":"could not parse RevocationList","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplsetup.go","lineNumber":224,"sourceCode":"\t\t{1, 2, 840, 10045, 4, 3, 2}, // oidSignatureECDSAWithSHA256\n\t\t{1, 2, 840, 10045, 4, 3, 3}, // oidSignatureECDSAWithSHA384\n\t\t{1, 2, 840, 10045, 4, 3, 4}, // oidSignatureECDSAWithSHA512\n\t}\n\tfor _, id := range ecdsaSignaureAlgorithms {\n\t\tif id.Equal(algid) {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}\n\nfunc (msp *bccspmsp) setupCRLs(conf *m.FabricMSPConfig) error {\n\t// setup the CRL (if present)\n\tmsp.CRL = make([]*pkix.CertificateList, len(conf.RevocationList))\n\tfor i, crlbytes := range conf.RevocationList {\n\t\tcrl, err := x509.ParseCRL(crlbytes)\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"could not parse RevocationList\")\n\t\t}\n\n\t\t// Massage the ECDSA signature values\n\t\tif isECDSASignatureAlgorithm(crl.SignatureAlgorithm.Algorithm) {\n\t\t\tr, s, err := utils.UnmarshalECDSASignature(crl.SignatureValue.RightAlign())\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tsig, err := utils.MarshalECDSASignature(r, s)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tcrl.SignatureValue = asn1.BitString{Bytes: sig, BitLength: 8 * len(sig)}\n\t\t}\n\n\t\t// TODO: pre-verify the signature on the CRL and create a map\n\t\t//       of CA certs to respective CRLs so that later upon\n\t\t//       validation we can already look up the CRL given the","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplsetup.go#L206-L242","documentation":"setupCRLs wraps an x509.ParseCRL failure: one of the entries in conf.RevocationList is not a parseable X.509 certificate revocation list. The underlying parse error identifies the exact DER problem (bad syntax, unsupported version, etc.).","triggerScenarios":"Thrown at msp/mspimplsetup.go:224 when the library encounters an invalid state.","commonSituations":"crls/ directory containing a certificate instead of a CRL; CRL exported in PEM but loaded without PEM-to-DER conversion; truncated file transfer; stale or corrupted CRL files after CA rotation.","solutions":["Regenerate/re-export the CRL from the CA (openssl ca -gencrl) and verify with openssl crl -in crl.pem -noout -text","Ensure the loader converts PEM CRLs to DER before adding to RevocationList","Remove or replace the malformed file in the MSP crls/ directory","Verify the CRL matches the CA that issued it and is complete (not truncated)"],"exampleFix":"// before: crl file is actually a certificate\n// after: place a real CRL in msp/crls/\n//   openssl ca -gencrl -out crl.pem && openssl crl -in crl.pem -outform DER -out crl.der\nnull","handlingStrategy":"validation","validationCode":"for i, crl := range conf.RevocationList {\n    if _, err := x509.ParseCRL(crl); err != nil {\n        return fmt.Errorf(\"RevocationList[%d] is not a valid DER CRL: %w\", i, err)\n    }\n}","typeGuard":"func isDerCRL(b []byte) bool {\n    _, err := x509.ParseCRL(b)\n    return err == nil\n}","tryCatchPattern":null,"preventionTips":["Store CRLs in DER (or convert PEM to DER before loading)","Keep crls/ free of certificates and keys — only CRL files","Verify each CRL with openssl crl -noout -text before deploying"],"tags":["x509","crl","parsing","hyperledger-fabric"],"backgroundTag":"invalid-crl-format","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}