{"record":{"id":"5720a479f1f669fb","repo":"oven-sh/bun","slug":"cert-revoked","errorCode":"CERT_REVOKED","errorMessage":"CERT_REVOKED","messagePattern":"CERT_REVOKED","errorType":"error_code","errorClass":"CertError","httpStatus":null,"severity":"critical","filePath":"src/http/error.rs","lineNumber":167,"sourceCode":"    #[error(\"ERROR_IN_CERT_NOT_AFTER_FIELD\")]\n    ERROR_IN_CERT_NOT_AFTER_FIELD,\n    #[error(\"ERROR_IN_CRL_LAST_UPDATE_FIELD\")]\n    ERROR_IN_CRL_LAST_UPDATE_FIELD,\n    #[error(\"ERROR_IN_CRL_NEXT_UPDATE_FIELD\")]\n    ERROR_IN_CRL_NEXT_UPDATE_FIELD,\n    #[error(\"OUT_OF_MEM\")]\n    OUT_OF_MEM,\n    #[error(\"DEPTH_ZERO_SELF_SIGNED_CERT\")]\n    DEPTH_ZERO_SELF_SIGNED_CERT,\n    #[error(\"SELF_SIGNED_CERT_IN_CHAIN\")]\n    SELF_SIGNED_CERT_IN_CHAIN,\n    #[error(\"UNABLE_TO_GET_ISSUER_CERT_LOCALLY\")]\n    UNABLE_TO_GET_ISSUER_CERT_LOCALLY,\n    #[error(\"UNABLE_TO_VERIFY_LEAF_SIGNATURE\")]\n    UNABLE_TO_VERIFY_LEAF_SIGNATURE,\n    #[error(\"CERT_CHAIN_TOO_LONG\")]\n    CERT_CHAIN_TOO_LONG,\n    #[error(\"CERT_REVOKED\")]\n    CERT_REVOKED,\n    #[error(\"INVALID_CA\")]\n    INVALID_CA,\n    #[error(\"PATH_LENGTH_EXCEEDED\")]\n    PATH_LENGTH_EXCEEDED,\n    #[error(\"INVALID_PURPOSE\")]\n    INVALID_PURPOSE,\n    #[error(\"CERT_UNTRUSTED\")]\n    CERT_UNTRUSTED,\n    #[error(\"CERT_REJECTED\")]\n    CERT_REJECTED,\n    #[error(\"SUBJECT_ISSUER_MISMATCH\")]\n    SUBJECT_ISSUER_MISMATCH,\n    #[error(\"AKID_SKID_MISMATCH\")]\n    AKID_SKID_MISMATCH,\n    #[error(\"AKID_ISSUER_SERIAL_MISMATCH\")]\n    AKID_ISSUER_SERIAL_MISMATCH,\n    #[error(\"KEYUSAGE_NO_CERTSIGN\")]","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L149-L185","documentation":"CertError::CERT_REVOKED maps BoringSSL X509 verify code 23 (X509_V_ERR_CERT_REVOKED) via get_cert_error_from_no() in src/http/lib.rs:1542. During path validation a CRL covering the certificate listed its serial as revoked, so the TLS connection is rejected. JS error.code is CERT_REVOKED with message 'certificate revoked' (FetchTasklet.rs:1437).","triggerScenarios":"TLS handshake against a server whose certificate (or an intermediate in its chain) was revoked by the CA's CRL; CRL data supplied in the verification context matches the cert's serial number.","commonSituations":"CA revoked the cert after compromise or mis-issuance and the operator missed the notice; test/lab CA with a stale CRL that accidentally lists the serial; revocation of an intermediate taking down all leafs under it.","solutions":["Check the CA's revocation status page / crt.sh for the cert serial, then request and install a fresh certificate","If an intermediate was revoked, get the server reissued under a different intermediate and serve the new chain","Confirm it is not a stale-CRL artifact: openssl verify -crl_check -CRLfile crl.pem leaf.pem","Only for throwaway test endpoints: tls: { rejectUnauthorized: false } — never in production"],"exampleFix":"// before\nawait fetch(\"https://revoked.example.com\");\n// after (test only): acknowledge revocation explicitly\nawait fetch(\"https://revoked.example.com\", {\n  tls: { rejectUnauthorized: false }, // test env only\n});","handlingStrategy":"try-catch","validationCode":"import tls from \"node:tls\";\nfunction ocspOk(host: string, port = 443): Promise<boolean> {\n  return new Promise((resolve) => {\n    const s = tls.connect({ host, port, servername: host }, () => { resolve(s.authorized); s.destroy(); });\n    s.on(\"error\", (err: any) => resolve(err?.code !== \"CERT_REVOKED\"));\n  });\n}\nconst ok = await ocspOk(\"partner.example.com\");","typeGuard":"function isCertRevoked(e: unknown): e is Error & { code: \"CERT_REVOKED\" } {\n  return e instanceof Error && (e as any).code === \"CERT_REVOKED\";\n}","tryCatchPattern":"try { return await fetch(url); } catch (e) { if (isCertRevoked(e)) { quarantineHost(new URL(url).host); throw new Error(`refusing revoked endpoint: ${url}`); } throw e; }","preventionTips":["Subscribe to CA revocation/downtime notices for certs you depend on","Cache last-known-good responses so a revoked upstream degrades gracefully","Never catch CERT_REVOKED and retry to a bypassed verification path"],"tags":["tls","certificate","revocation","fetch","security"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}