{"record":{"id":"6db38542918c32f3","repo":"oven-sh/bun","slug":"unable-to-get-crl","errorCode":null,"errorMessage":"UNABLE_TO_GET_CRL","messagePattern":"UNABLE_TO_GET_CRL","errorType":"error_code","errorClass":"CertError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":127,"sourceCode":"    Sys(#[from] bun_errno::SystemErrno),\n    #[error(transparent)]\n    Zlib(bun_zlib::ZlibError),\n    #[error(transparent)]\n    Brotli(bun_brotli::Error),\n    #[error(transparent)]\n    Zstd(bun_zstd::ZstdError),\n    #[error(transparent)]\n    Picohttp(bun_picohttp::ParseResponseError),\n}\n\n#[allow(non_camel_case_types)]\n#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error, strum::IntoStaticStr)]\npub enum CertError {\n    #[error(\"OK\")]\n    OK,\n    #[error(\"UNABLE_TO_GET_ISSUER_CERT\")]\n    UNABLE_TO_GET_ISSUER_CERT,\n    #[error(\"UNABLE_TO_GET_CRL\")]\n    UNABLE_TO_GET_CRL,\n    #[error(\"UNABLE_TO_DECRYPT_CERT_SIGNATURE\")]\n    UNABLE_TO_DECRYPT_CERT_SIGNATURE,\n    #[error(\"UNABLE_TO_DECRYPT_CRL_SIGNATURE\")]\n    UNABLE_TO_DECRYPT_CRL_SIGNATURE,\n    #[error(\"UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY\")]\n    UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY,\n    #[error(\"CERT_SIGNATURE_FAILURE\")]\n    CERT_SIGNATURE_FAILURE,\n    #[error(\"CRL_SIGNATURE_FAILURE\")]\n    CRL_SIGNATURE_FAILURE,\n    #[error(\"CERT_NOT_YET_VALID\")]\n    CERT_NOT_YET_VALID,\n    #[error(\"CERT_HAS_EXPIRED\")]\n    CERT_HAS_EXPIRED,\n    #[error(\"CRL_NOT_YET_VALID\")]\n    CRL_NOT_YET_VALID,\n    #[error(\"CRL_HAS_EXPIRED\")]","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L109-L145","documentation":"X509 verify result 3 (X509_V_ERR_UNABLE_TO_GET_CRL): certificate-chain validation was configured to check revocation via CRLs, and no Certificate Revocation List could be found for a certificate in the chain. Bun translates the BoringSSL verify code through get_cert_error_from_no (src/http/lib.rs:1522) into CertError::UNABLE_TO_GET_CRL, rejecting the TLS handshake with message \"unable to get certificate CRL\" (FetchTasklet.rs:1379).","triggerScenarios":"A TLS connection (fetch/https/Bun.connect, including proxied CONNECT tunnels) where CRL-based revocation checking is active and the CA publishes no (or an unreachable) CRL for the cert. Rare with Bun's default configuration, which does not require CRLs.","commonSituations":"Internal PKIs with CRL checking enabled but no CRL distribution points hosted, a CRL URL that is down/unreachable (the verifier treats it as missing), or hardened environments that turn on strict revocation checking.","solutions":["Publish and host the CA's CRL at the cRLDistributionPoint URL embedded in the certificate and make sure it is reachable","Disable mandatory CRL checking on the client for that host (rely on OCSP or the CA's assurance) — Bun's default fetch does not require CRLs, so remove any custom checkServerIdentity/verify setup that enables it","Switch the PKI to OCSP-based revocation so no CRL lookup is needed","For internal CAs where revocation is handled operationally, add the CA to the trust list so leaf checks short-circuit before CRL lookup"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"function isCertErrorCode(e: unknown, code = \"UNABLE_TO_GET_CRL\"): e is Error & { code: string } {\n  return e instanceof Error && (e as any).code === code;\n}","tryCatchPattern":"try {\n  await fetch(url);\n} catch (e) {\n  if (isCertErrorCode(e, \"UNABLE_TO_GET_CRL\")) {\n    // CRL infrastructure problem — escalate to the PKI team rather than bypassing\n    throw new Error(\"Revocation (CRL) unavailable for peer certificate\");\n  }\n  throw e;\n}","preventionTips":["Prefer OCSP-capable CAs so clients never need CRL fetches","Keep cRLDistributionPoint URLs reachable and monitored if your PKI uses CRLs","Don't enable strict CRL revocation on clients unless the PKI actually publishes CRLs"],"tags":["tls","certificates","crl","revocation","fetch"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}