{"record":{"id":"6f0c15d2d81afb99","repo":"grpc/grpc-go","slug":"trailing-data-after-issuingdistributionpoint-exten","errorCode":null,"errorMessage":"trailing data after IssuingDistributionPoint extension","messagePattern":"trailing data after IssuingDistributionPoint extension","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"security/advancedtls/crl.go","lineNumber":341,"sourceCode":"\t\tswitch {\n\t\tcase oidDeltaCRLIndicator.Equal(ext.Id):\n\t\t\treturn nil, fmt.Errorf(\"delta CRLs unsupported\")\n\n\t\tcase oidAuthorityKeyIdentifier.Equal(ext.Id):\n\t\t\tvar a authKeyID\n\t\t\tif rest, err := asn1.Unmarshal(ext.Value, &a); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"asn1.Unmarshal failed: %v\", err)\n\t\t\t} else if len(rest) != 0 {\n\t\t\t\treturn nil, errors.New(\"trailing data after AKID extension\")\n\t\t\t}\n\t\t\tcertList.authorityKeyID = a.ID\n\n\t\tcase oidIssuingDistributionPoint.Equal(ext.Id):\n\t\t\tvar dp issuingDistributionPoint\n\t\t\tif rest, err := asn1.Unmarshal(ext.Value, &dp); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"asn1.Unmarshal failed: %v\", err)\n\t\t\t} else if len(rest) != 0 {\n\t\t\t\treturn nil, errors.New(\"trailing data after IssuingDistributionPoint extension\")\n\t\t\t}\n\n\t\t\tif dp.OnlyContainsUserCerts || dp.OnlyContainsCACerts || dp.OnlyContainsAttributeCerts {\n\t\t\t\treturn nil, errors.New(\"CRL only contains some certificate types\")\n\t\t\t}\n\t\t\tif dp.IndirectCRL {\n\t\t\t\treturn nil, errors.New(\"indirect CRLs unsupported\")\n\t\t\t}\n\t\t\tif dp.OnlySomeReasons.BitLength != 0 {\n\t\t\t\treturn nil, errors.New(\"onlySomeReasons unsupported\")\n\t\t\t}\n\n\t\tcase ext.Critical:\n\t\t\treturn nil, fmt.Errorf(\"unsupported critical extension: %v\", ext.Id)\n\t\t}\n\t}\n\n\tif len(certList.authorityKeyID) == 0 {","sourceCodeStart":323,"sourceCodeEnd":359,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/security/advancedtls/crl.go#L323-L359","documentation":"Returned by parseCRLExtensions (security/advancedtls/crl.go:341) when ASN.1 unmarshalling the Issuing Distribution Point extension leaves trailing bytes. Like the AKID check, leftover bytes mean the IDP extension is not a well-formed DER encoding. The check is at lines 336-342.","triggerScenarios":"A CRL whose IDP extension value contains extra bytes after the SEQUENCE, or is otherwise non-canonical; a malformed CRL produced by a non-conformant CA or corrupted in transit.","commonSituations":"Buggy CA IDP encoding; CRL truncated/concatenated during download; CDN or proxy altering the bytes; non-minimal DER produced by older tooling.","solutions":["Re-download the CRL from its authoritative distribution point to eliminate transfer corruption.","Have the CA regenerate the CRL with a conformant IDP extension.","Inspect with openssl crl to confirm the extension decodes cleanly.","If the file is structurally invalid, replace it rather than retrying verification on it."],"exampleFix":"# before: malformed IDP in /etc/crls/ca.crl\nopenssl crl -inform DER -in /etc/crls/ca.crl -text -noout # error\n\n# after: refresh from source\ncurl -sfo /etc/crls/ca.crl https://ca.example.com/ca.crl\nopenssl crl -inform DER -in /etc/crls/ca.crl -text -noout # OK","handlingStrategy":"validation","validationCode":"var dp issuingDistributionPoint\nrest, err := asn1.Unmarshal(idpExt.Value, &dp)\nif err != nil || len(rest) != 0 {\n    return fmt.Errorf(\"CRL has malformed IDP extension\")\n}","typeGuard":null,"tryCatchPattern":"_, err := crl.Verify(cert, opts)\nif err != nil && strings.Contains(err.Error(), \"trailing data after IssuingDistributionPoint\") {\n    // re-fetch CRL, then retry\n}","preventionTips":["Re-download CRLs from the authoritative source to rule out corruption.","Inspect IDP encoding with openssl.","Replace structurally invalid CRLs rather than retrying."],"tags":["go","grpc","security","tls","crl","x509","asn1","pkix"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}