{"record":{"id":"7a5732b20fd14a1d","repo":"apereo/cas","slug":"unable-to-fetch","errorCode":null,"errorMessage":"Unable to fetch [{}]","messagePattern":"Unable to fetch \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/ResourceCRLFetcher.java","lineNumber":61,"sourceCode":"    }\n\n    @Override\n    public X509CRL fetch(final URI crl) throws Exception {\n        return fetch(crl.toURL());\n    }\n\n    @Override\n    public X509CRL fetch(final URL crl) throws Exception {\n        return fetch(new UrlResource(crl));\n    }\n\n    @Override\n    public X509CRL fetch(final Resource crl) throws Exception {\n        val results = fetch(CollectionUtils.wrap(crl));\n        if (!results.isEmpty()) {\n            return results.iterator().next();\n        }\n        LOGGER.warn(\"Unable to fetch [{}]\", crl);\n        return null;\n    }\n}\n","sourceCodeStart":43,"sourceCodeEnd":65,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/ResourceCRLFetcher.java#L43-L65","documentation":"ResourceCRLFetcher.fetch failed to obtain an X509CRL from the given Spring Resource (file, HTTP, LDAP URL, etc.). The batch fetch returned an empty result, so this warning is logged and null is returned, causing CRL-based revocation checking to have no certificate revocation list to work with.","triggerScenarios":"Calling fetch(Resource) (or the batch fetch(Collection<Resource>)) with a resource whose CRL cannot be loaded: the file/URL is unreachable, the resource does not exist, the remote server returns an error, or the fetched data cannot be parsed as a CRL.","commonSituations":"CRL distribution point URL points to a file path or HTTP endpoint that moved or is down; cron-based CRL refresh caches a stale/empty download; wrong path in cas.authn.x509 revocation CRL resource settings; firewall blocks the CRL endpoint.","solutions":["Verify the CRL resource URI is reachable and correct: open the file/URL directly (curl or browser) and confirm it downloads a valid CRL.","Check file permissions and existence if the resource is a local file path; correct the path in the X509 revocation configuration.","Inspect earlier log lines for the underlying cause logged by the batch fetch, and fix the connection/parse error reported there.","Configure a fallback or cached CRL store and ensure the revocation checker can proceed when a single CRL is unavailable."],"exampleFix":"// before\ncas.authn.x509.revocation.crl-resources=file:///etc/cas/crls/old-ca.crl\n// after (correct, existing path)\ncas.authn.x509.revocation.crl-resources=file:///etc/cas/crls/ca.crl","handlingStrategy":"validation","validationCode":"// Pre-flight check the CRL resource before handing it to the fetcher:\nval resource = new UrlResource(crlUri);\nif (!resource.exists()) {\n    throw new IllegalStateException(\"CRL resource not reachable: \" + crlUri);\n}\nreturn resource;","typeGuard":null,"tryCatchPattern":"try {\n    X509CRL crl = fetcher.fetch(crlResource);\n    if (crl == null) {\n        logger.warn(\"CRL unavailable for {}; using cached CRL if present\", crlResource);\n        return cachedCrl; // fallback\n    }\n    return crl;\n} catch (Exception e) {\n    logger.error(\"Failed to fetch CRL from {}\", crlResource, e);\n    return cachedCrl;\n}","preventionTips":["Monitor CRL distribution-point URLs for availability (HTTP 200 and non-empty body).","Keep a cached last-known-good CRL and refresh on a schedule rather than fetching on demand.","Verify file paths and permissions for file:// CRL resources in every environment.","Test CRL endpoints after any CA/infrastructure change."],"tags":["x509","crl","certificate-revocation","resource-fetch"],"backgroundTag":"resource-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}