{"record":{"id":"7fe715b356fac877","repo":"gchq/CyberChef","slug":"crlnumber-crl-entry-extension-missing-num-key","errorCode":null,"errorMessage":"'cRLNumber' CRL entry extension missing 'num' key: ${ext}","messagePattern":"'cRLNumber' CRL entry extension missing 'num' key: (.+?)","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/ParseX509CRL.mjs","lineNumber":187,"sourceCode":"                    out += `\\tkeyid:${colonDelimitedHexFormatString(ext.kid.hex.toUpperCase())}\\n`;\n                }\n                if (Object.hasOwn(ext, \"issuer\")) {\n                    out += `\\tDirName:${ext.issuer.str}\\n`;\n                }\n                if (Object.hasOwn(ext, \"sn\")) {\n                    out += `\\tserial:${colonDelimitedHexFormatString(ext.sn.hex.toUpperCase())}\\n`;\n                }\n                break;\n            case \"cRLDistributionPoints\":\n                out += `X509v3 CRL Distribution Points:\\n`;\n                ext.array.forEach((distPoint) => {\n                    const fullName = `Full Name:\\n${formatGeneralNames(distPoint.dpname.full, 4)}`;\n                    out += indentString(fullName, 4) + \"\\n\";\n                });\n                break;\n            case \"cRLNumber\":\n                if (!Object.hasOwn(ext, \"num\")) {\n                    throw new OperationError(`'cRLNumber' CRL entry extension missing 'num' key: ${ext}`);\n                }\n                out += `X509v3 CRL Number:\\n\\t${ext.num.hex.toUpperCase()}\\n`;\n                break;\n            case \"issuerAltName\":\n                out += `X509v3 Issuer Alternative Name:\\n${formatGeneralNames(ext.array, 4)}\\n`;\n                break;\n            default:\n                out += `${ext.extname}:\\n`;\n                out += `\\tUnsupported CRL extension. Try openssl CLI.\\n`;\n                break;\n        }\n    });\n\n    return indentString(chop(out), indent);\n}\n\n/**\n * Format general names array.","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/ParseX509CRL.mjs#L169-L205","documentation":"When a CRL extension has extname 'cRLNumber', formatCRLExtensions requires a 'num' key holding the CRL number hex value. If that key is absent the op throws, because it cannot render the number. This is an assertion about jsrsasign's parsed cRLNumber structure.","triggerScenarios":"A CRL with a cRLNumber extension (OID 2.5.29.20) whose parsed object lacks 'num'; a malformed or truncated extension value; jsrsasign version returning a different key name for the CRL number.","commonSituations":"Parsing CRLs where the cRLNumber criticality/encoding is non-standard; version skew in jsrsasign; corrupt CRL bytes that still partially parse.","solutions":["Inspect the extension with openssl ('openssl crl -in crl.pem -noout -text') to confirm the cRLNumber is well-formed.","Re-download the CRL from the CA distribution point.","Verify the jsrsasign version bundled with CyberChef matches expectations.","Report the CRL if it is RFC-conformant but the op rejects it — the key check may be too strict."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const crl = new r.X509CRL(input);\nconst numExt = (crl.getParam().ext || []).find(e => e.extname === \"cRLNumber\");\nif (numExt && !Object.hasOwn(numExt, \"num\")) {\n  throw new Error(\"cRLNumber extension is missing 'num'\");\n}","typeGuard":"function isValidCrlNumberExtension(ext) {\n  return ext.extname !== \"cRLNumber\" || Object.hasOwn(ext, \"num\");\n}","tryCatchPattern":"try {\n  return parseX509CRL.run(crlInput, [inputFormat]);\n} catch (e) {\n  if (e.message.includes(\"'cRLNumber' CRL entry extension missing 'num'\")) {\n    // non-standard cRLNumber encoding; validate externally\n  }\n  throw e;\n}","preventionTips":["Validate CRLs with openssl before parsing.","Keep jsrsasign version aligned.","Re-download CRLs from a trusted distribution point."],"tags":["crypto","x509","crl","parsing","extensions"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}