{"record":{"id":"875d2a2e60dd0861","repo":"oven-sh/bun","slug":"invalidcrl","errorCode":null,"errorMessage":"InvalidCRL","messagePattern":"InvalidCRL","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/http/InitError.rs","lineNumber":11,"sourceCode":"#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error, strum::IntoStaticStr)]\npub enum InitError {\n    #[error(\"FailedToOpenSocket\")]\n    FailedToOpenSocket,\n    #[error(\"LoadCAFile\")]\n    LoadCAFile,\n    #[error(\"InvalidCAFile\")]\n    InvalidCAFile,\n    #[error(\"InvalidCA\")]\n    InvalidCA,\n    #[error(\"InvalidCRL\")]\n    InvalidCRL,\n}\n","sourceCodeStart":1,"sourceCodeEnd":14,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/InitError.rs#L1-L14","documentation":"An inline certificate revocation list (CRL) supplied in the TLS options failed to parse (uws invalid_crl mapped at src/http/HTTPContext.rs:521; fatal message 'the provided CRL is invalid' at src/http/HTTPThread.rs:372-374). BoringSSL accepted the CA material but rejected the CRL blob, so the SSL context cannot be created and the process crashes.","triggerScenarios":"Configuring a CRL for fetch/Bun.install TLS verification where the CRL bytes are DER instead of PEM, stale/corrupted, or truncated — mirrors the CA configuration path in HTTPThreadInitOpts (src/http/HTTPContext.rs:538-558).","commonSituations":"Enterprise PKI setups piping CRLs from an internal distribution point into config; CRL files refreshed by cron jobs that half-failed; PEM/DER format mismatch between what the PKI team publishes and what the client expects.","solutions":["Validate the CRL: `openssl crl -in crl.pem -noout -text` (add `-inform der` if it is DER — then convert: `openssl crl -inform der -in crl.der -out crl.pem`).","Re-download a fresh CRL from the distribution point — a truncated transfer is the most common corruption.","Confirm the CRL is issued by the same CA you configured (issuer mismatch also fails parsing-based setup).","If you do not actually need revocation checking, drop the CRL option entirely."],"exampleFix":"# before\n# tls.crl = binary DER downloaded from CDP\ncurl -s http://pki.corp/crl.der -o crl.der   # used directly -> InvalidCRL\n# after\nopenssl crl -inform der -in crl.der -out crl.pem\nopenssl crl -in crl.pem -noout   # sanity check\n# point config at crl.pem","handlingStrategy":"validation","validationCode":"import { execSync } from 'node:child_process';\nexecSync('openssl crl -in crl.pem -noout', { stdio: 'pipe' }); // throws on invalid CRL\n// then configure tls with the verified file","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use PEM-format CRLs; convert DER with `openssl crl -inform der`","Automate CRL refresh and validate on each rotation","Drop the CRL option entirely if revocation checking is not required"],"tags":["tls","crl","pki","config","crash"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}