{"record":{"id":"892656517f6b6fd5","repo":"grpc/grpc-go","slug":"extractcrlissuer-invalid-asn-1-encoding","errorCode":null,"errorMessage":"extractCRLIssuer: invalid ASN.1 encoding","messagePattern":"extractCRLIssuer: invalid ASN\\.1 encoding","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"security/advancedtls/crl.go","lineNumber":417,"sourceCode":"\treturn crlBytes\n}\n\n// extractCRLIssuer extracts the raw ASN.1 encoding of the CRL issuer. Due to the design of\n// pkix.CertificateList and pkix.RDNSequence, it is not possible to reliably marshal the\n// parsed Issuer to its original raw encoding.\nfunc extractCRLIssuer(crlBytes []byte) ([]byte, error) {\n\tif bytes.HasPrefix(crlBytes, crlPemPrefix) {\n\t\tcrlBytes = crlPemToDer(crlBytes)\n\t}\n\tder := cryptobyte.String(crlBytes)\n\tvar issuer cryptobyte.String\n\t// This doubled der.ReadASN1 is intentional, it modifies the input buffer\n\tif !der.ReadASN1(&der, cbasn1.SEQUENCE) ||\n\t\t!der.ReadASN1(&der, cbasn1.SEQUENCE) ||\n\t\t!der.SkipOptionalASN1(cbasn1.INTEGER) ||\n\t\t!der.SkipASN1(cbasn1.SEQUENCE) ||\n\t\t!der.ReadASN1Element(&issuer, cbasn1.SEQUENCE) {\n\t\treturn nil, errors.New(\"extractCRLIssuer: invalid ASN.1 encoding\")\n\t}\n\treturn issuer, nil\n}\n\n// parseRevocationList comes largely from here\n// x509.go:\n// https://github.com/golang/go/blob/e2f413402527505144beea443078649380e0c545/src/crypto/x509/x509.go#L1669-L1690\n// We must first convert PEM to DER to be able to use the new\n// x509.ParseRevocationList instead of the deprecated x509.ParseCRL\nfunc parseRevocationList(crlBytes []byte) (*x509.RevocationList, error) {\n\tif bytes.HasPrefix(crlBytes, crlPemPrefix) {\n\t\tcrlBytes = crlPemToDer(crlBytes)\n\t}\n\tcrl, err := x509.ParseRevocationList(crlBytes)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn crl, nil","sourceCodeStart":399,"sourceCodeEnd":435,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/security/advancedtls/crl.go#L399-L435","documentation":"Returned by extractCRLIssuer (crl.go:417) when it cannot navigate the expected ASN.1 structure of the CRL bytes (outer SEQUENCE, inner SEQUENCE, skip version INTEGER, skip signatureAlg SEQUENCE, then read the issuer Name element). It uses cryptobyte ReadASN1/Skip calls in sequence; if any returns false the bytes are malformed or not a CRL. The function needs the raw issuer DN which pkix.CertificateList cannot reliably re-marshal.","triggerScenarios":"Passing corrupt, truncated, or non-CRL bytes (e.g. a certificate, a plain text error page, or a partial download) to a code path that calls extractCRLIssuer to obtain the CRL issuer. Also triggered by a PEM block whose decoded payload is not a valid CertificateList.","commonSituations":"A CRL download over HTTP that returned an HTML error page or was truncated; passing a DER certificate instead of a CRL; encoding/decoding mismatch (double base64, wrong PEM type); network proxy mangling the payload.","solutions":["Re-download the CRL and verify it parses independently: `openssl crl -in crl.der -inform DER -noout -text` (or `-inform PEM`).","Ensure you pass raw DER or a proper '-----BEGIN X509 CRL-----' PEM block; extractCRLIssuer only auto-strips the X509 CRL PEM prefix.","Check the byte length and magic bytes against a known-good CRL; log the first bytes to detect HTML/text payloads."],"exampleFix":"// before: feeding a truncated/garbage byte slice -> invalid ASN.1 encoding\n// after: validate with x509 first, then pass to advancedtls\n//   if _, err := x509.ParseRevocationList(rawDER); err != nil {\n//       return fmt.Errorf(\"not a valid CRL, re-download: %w\", err)\n//   }","handlingStrategy":"validation","validationCode":"import \"crypto/x509\"\n\nfunc isValidCRLDER(b []byte) error {\n    if _, err := x509.ParseRevocationList(b); err != nil {\n        return fmt.Errorf(\"bytes are not a valid CRL: %w\", err)\n    }\n    return nil\n}\n\n// call before extractCRLIssuer / advancedtls CRL ingestion","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify HTTP CRL downloads return DER/PEM, not HTML error pages (check Content-Type and first bytes).","Validate with x509.ParseRevocationList before feeding bytes to advancedtls.","Log byte length and hex prefix of received CRL payloads to catch truncation."],"tags":["crl","advancedtls","asn1","security","pki","encoding"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}