{"record":{"id":"61b7a8c97340e0fc","repo":"oven-sh/bun","slug":"unable-to-get-crl-issuer","errorCode":"UNABLE_TO_GET_CRL_ISSUER","errorMessage":"UNABLE_TO_GET_CRL_ISSUER","messagePattern":"UNABLE_TO_GET_CRL_ISSUER","errorType":"error_code","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":187,"sourceCode":"    #[error(\"INVALID_CA\")]\n    INVALID_CA,\n    #[error(\"PATH_LENGTH_EXCEEDED\")]\n    PATH_LENGTH_EXCEEDED,\n    #[error(\"INVALID_PURPOSE\")]\n    INVALID_PURPOSE,\n    #[error(\"CERT_UNTRUSTED\")]\n    CERT_UNTRUSTED,\n    #[error(\"CERT_REJECTED\")]\n    CERT_REJECTED,\n    #[error(\"SUBJECT_ISSUER_MISMATCH\")]\n    SUBJECT_ISSUER_MISMATCH,\n    #[error(\"AKID_SKID_MISMATCH\")]\n    AKID_SKID_MISMATCH,\n    #[error(\"AKID_ISSUER_SERIAL_MISMATCH\")]\n    AKID_ISSUER_SERIAL_MISMATCH,\n    #[error(\"KEYUSAGE_NO_CERTSIGN\")]\n    KEYUSAGE_NO_CERTSIGN,\n    #[error(\"UNABLE_TO_GET_CRL_ISSUER\")]\n    UNABLE_TO_GET_CRL_ISSUER,\n    #[error(\"UNHANDLED_CRITICAL_EXTENSION\")]\n    UNHANDLED_CRITICAL_EXTENSION,\n    #[error(\"KEYUSAGE_NO_CRL_SIGN\")]\n    KEYUSAGE_NO_CRL_SIGN,\n    #[error(\"UNHANDLED_CRITICAL_CRL_EXTENSION\")]\n    UNHANDLED_CRITICAL_CRL_EXTENSION,\n    #[error(\"INVALID_NON_CA\")]\n    INVALID_NON_CA,\n    #[error(\"PROXY_PATH_LENGTH_EXCEEDED\")]\n    PROXY_PATH_LENGTH_EXCEEDED,\n    #[error(\"KEYUSAGE_NO_DIGITAL_SIGNATURE\")]\n    KEYUSAGE_NO_DIGITAL_SIGNATURE,\n    #[error(\"PROXY_CERTIFICATES_NOT_ALLOWED\")]\n    PROXY_CERTIFICATES_NOT_ALLOWED,\n    #[error(\"INVALID_EXTENSION\")]\n    INVALID_EXTENSION,\n    #[error(\"INVALID_POLICY_EXTENSION\")]","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L169-L205","documentation":"CertError::UNABLE_TO_GET_CRL_ISSUER maps BoringSSL X509 verify code 33 (X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER) via get_cert_error_from_no() in src/http/lib.rs:1552. CRL-based checking is in play and a CRL was found, but the certificate that issued the CRL cannot be located in the verification context, so revocation status cannot be completed. JS error.code is UNABLE_TO_GET_CRL_ISSUER with message 'unable to get CRL issuer certificate' (FetchTasklet.rs:1481).","triggerScenarios":"TLS handshake where revocation checking via CRLs is active and the CRL presented/found is signed by an issuer cert that is not in the chain or trust store (e.g., dedicated CRL-signing delegated cert).","commonSituations":"Private PKI that delegates CRL signing to a separate key ( indirect CRL ), CRL signer cert not distributed alongside the CA bundle, enterprise gateways that inject CRL checking then fail on incomplete issuer sets.","solutions":["Identify the CRL signer: openssl crl -in crl.pem -noout -issuer, then obtain that certificate from the CA","Add the CRL issuer certificate to the chain/CA material so validation can link it","If you operate the PKI, drop the indirect-CRL setup and let the CA sign its own CRLs","Fallback for endpoints you control: disable CRL enforcement for that connection path (no CRLs supplied means no CRL-based failure)"],"exampleFix":"# before: indirect CRL signer not shipped\nopenssl crl -in crl.pem -noout -issuer\n# issuer: CN=Corp CRL Signer, O=Corp  <- cert missing from bundle\n# after: include the CRL signer cert alongside the CA\nopenssl crl -in crl.pem -CAfile crl-signer.pem -noout  # verify CRL signature OK\ncat ca.pem crl-signer.pem > bundle.pem  # distribute bundle.pem","handlingStrategy":"try-catch","validationCode":"import { execSync } from \"node:child_process\";\nconst crlIssuer = execSync(\"openssl crl -in crl.pem -noout -issuer\").toString();\nconst haveIt = execSync(\"openssl verify -CAfile bundle.pem crl.pem 2>&1 || true\").toString();\n// if the CRL signature cannot be verified against bundle.pem, the CRL issuer cert is missing","typeGuard":"function isCrlIssuerMissing(e: unknown): e is Error & { code: \"UNABLE_TO_GET_CRL_ISSUER\" } {\n  return e instanceof Error && (e as any).code === \"UNABLE_TO_GET_CRL_ISSUER\";\n}","tryCatchPattern":"try { await fetch(url); } catch (e) { if (isCrlIssuerMissing(e)) { logger.warn(\"CRL issuer cert unavailable for \" + url); return fetchWithoutCrlContext(url); } throw e; }","preventionTips":["Ship CRL signer certs with the CA bundle when using delegated CRL signing","Prefer OCSP/AIA over hand-managed CRLs where possible","Document indirect-CRL signer certs in PKI runbooks"],"tags":["tls","certificate","crl","revocation","pki"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}