{"record":{"id":"8d19c2b4b0517b3c","repo":"grpc/grpc-java","slug":"crl-in-default-validation-context-is-not-supported","errorCode":null,"errorMessage":"crl in default_validation_context is not supported","messagePattern":"crl in default_validation_context is not supported","errorType":"validation","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/XdsClusterResource.java","lineNumber":524,"sourceCode":"        if (matchSubjectAltNamesCount > 0 && server) {\n          throw new ResourceInvalidException(\n              \"match_subject_alt_names only allowed in upstream_tls_context\");\n        }\n        if (certificateValidationContext.getVerifyCertificateSpkiCount() > 0) {\n          throw new ResourceInvalidException(\n              \"verify_certificate_spki in default_validation_context is not supported\");\n        }\n        if (certificateValidationContext.getVerifyCertificateHashCount() > 0) {\n          throw new ResourceInvalidException(\n              \"verify_certificate_hash in default_validation_context is not supported\");\n        }\n        if (certificateValidationContext.hasRequireSignedCertificateTimestamp()) {\n          throw new ResourceInvalidException(\n              \"require_signed_certificate_timestamp in default_validation_context is not \"\n                  + \"supported\");\n        }\n        if (certificateValidationContext.hasCrl()) {\n          throw new ResourceInvalidException(\"crl in default_validation_context is not supported\");\n        }\n        if (certificateValidationContext.hasCustomValidatorConfig()) {\n          throw new ResourceInvalidException(\n              \"custom_validator_config in default_validation_context is not supported\");\n        }\n      }\n    }\n  }\n\n  private static String getIdentityCertInstanceName(CommonTlsContext commonTlsContext) {\n    if (commonTlsContext.hasTlsCertificateProviderInstance()) {\n      return commonTlsContext.getTlsCertificateProviderInstance().getInstanceName();\n    }\n    // Fall back to deprecated field (field 11) for backward compatibility with Istio\n    @SuppressWarnings(\"deprecation\")\n    String instanceName = commonTlsContext.hasTlsCertificateCertificateProviderInstance()\n        ? commonTlsContext.getTlsCertificateCertificateProviderInstance().getInstanceName()\n        : null;","sourceCodeStart":506,"sourceCodeEnd":542,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/XdsClusterResource.java#L506-L542","documentation":"gRPC xDS rejects a CertificateValidationContext whose default_validation_context carries a crl field. CRL-based revocation checking is not implemented by grpc-java's xDS transport security, so the cluster resource is invalid and rejected with ResourceInvalidException.","triggerScenarios":"A Cluster's upstream_tls_context -> common_tls_context -> validation_context.default_validation_context sets crl (a DataSource pointing to a CRL), reaching validateCommonTlsContext via validateUpstreamTlsContext.","commonSituations":"PKI setups with revocation requirements ported from Envoy; control planes always emitting crl alongside trust_ca; enterprise security baselines mandating CRL checking.","solutions":["Remove crl from default_validation_context","Handle revocation outside xDS (rotate trust_ca promptly on compromise)","Use short-lived workload certificates (e.g. SPIFFE/SDS) to reduce revocation need","Track grpc-java xDS roadmap for CRL support"],"exampleFix":"# before\nvalidation_context:\n  default_validation_context:\n    crl: { filename: \"/etc/crl.pem\" }\n# after\nvalidation_context:\n  default_validation_context: {}\n  trust_ca: { ... }","handlingStrategy":"validation","validationCode":"if (ctx.getDefaultValidationContext().hasCrl()) {\n  throw new IllegalArgumentException(\"crl unsupported by grpc-java xDS\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  cluster = XdsClusterResource.parse(resource);\n} catch (ResourceInvalidException e) {\n  logger.warn(\"Cluster rejected: {}\", e.getMessage());\n}","preventionTips":["Handle CRL/revocation outside the xDS data plane","Use short-lived certificates (SDS/SPIFFE) to minimize revocation needs","Rotate trust_ca quickly on compromise instead of relying on CRLs"],"tags":["xds","grpc-java","tls","crl","revocation"],"backgroundTag":"unsupported-config-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}