{"record":{"id":"63904f32574b6261","repo":"oven-sh/bun","slug":"unable-to-decrypt-crl-signature","errorCode":null,"errorMessage":"UNABLE_TO_DECRYPT_CRL_SIGNATURE","messagePattern":"UNABLE_TO_DECRYPT_CRL_SIGNATURE","errorType":"error_code","errorClass":"CertError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":131,"sourceCode":"    Brotli(bun_brotli::Error),\n    #[error(transparent)]\n    Zstd(bun_zstd::ZstdError),\n    #[error(transparent)]\n    Picohttp(bun_picohttp::ParseResponseError),\n}\n\n#[allow(non_camel_case_types)]\n#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error, strum::IntoStaticStr)]\npub enum CertError {\n    #[error(\"OK\")]\n    OK,\n    #[error(\"UNABLE_TO_GET_ISSUER_CERT\")]\n    UNABLE_TO_GET_ISSUER_CERT,\n    #[error(\"UNABLE_TO_GET_CRL\")]\n    UNABLE_TO_GET_CRL,\n    #[error(\"UNABLE_TO_DECRYPT_CERT_SIGNATURE\")]\n    UNABLE_TO_DECRYPT_CERT_SIGNATURE,\n    #[error(\"UNABLE_TO_DECRYPT_CRL_SIGNATURE\")]\n    UNABLE_TO_DECRYPT_CRL_SIGNATURE,\n    #[error(\"UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY\")]\n    UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY,\n    #[error(\"CERT_SIGNATURE_FAILURE\")]\n    CERT_SIGNATURE_FAILURE,\n    #[error(\"CRL_SIGNATURE_FAILURE\")]\n    CRL_SIGNATURE_FAILURE,\n    #[error(\"CERT_NOT_YET_VALID\")]\n    CERT_NOT_YET_VALID,\n    #[error(\"CERT_HAS_EXPIRED\")]\n    CERT_HAS_EXPIRED,\n    #[error(\"CRL_NOT_YET_VALID\")]\n    CRL_NOT_YET_VALID,\n    #[error(\"CRL_HAS_EXPIRED\")]\n    CRL_HAS_EXPIRED,\n    #[error(\"ERROR_IN_CERT_NOT_BEFORE_FIELD\")]\n    ERROR_IN_CERT_NOT_BEFORE_FIELD,\n    #[error(\"ERROR_IN_CERT_NOT_AFTER_FIELD\")]","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L113-L149","documentation":"X509 verify result 5 (X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE): the CRL's signature could not be decrypted with the issuing CA's public key, so the CRL cannot be trusted. Mapped via get_cert_error_from_no (src/http/lib.rs:1524) to CertError::UNABLE_TO_DECRYPT_CRL_SIGNATURE, message \"unable to decrypt CRL's signature\" (FetchTasklet.rs:1385).","triggerScenarios":"A TLS handshake with CRL checking active where the fetched CRL was not signed by the CA that issued the certificate (stale or mismatched CRL), or the CRL bytes are corrupt.","commonSituations":"Internal PKIs after CA rotation where old CRLs remain published, manually assembled CRL bundles with the wrong file, or CRL distribution points serving truncated downloads.","solutions":["Re-publish the current CRL signed by the active CA at the cRLDistributionPoint URL","Confirm the CRL is intact: openssl crl -in crl.pem -noout -text and verify its signature against the CA cert","Disable CRL-based checking on the client for this host and rely on OCSP","Rotate the environment to a PKI that does not depend on CRLs"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"function isCertErrorCode(e: unknown, code = \"UNABLE_TO_DECRYPT_CRL_SIGNATURE\"): e is Error & { code: string } {\n  return e instanceof Error && (e as any).code === code;\n}","tryCatchPattern":"try {\n  await fetch(url);\n} catch (e) {\n  if (isCertErrorCode(e, \"UNABLE_TO_DECRYPT_CRL_SIGNATURE\")) {\n    // PKI-side CRL problem; disable CRL requirement for this host or escalate\n    throw new Error(\"Peer CRL failed signature validation\");\n  }\n  throw e;\n}","preventionTips":["Re-sign and republish CRLs immediately after any CA key rotation","Automate CRL generation so stale/mismatched CRLs are never served","Validate CRLs in PKI CI: openssl crl -CAfile ca.pem -noout -verify"],"tags":["tls","certificates","crl","revocation","fetch"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}