{"record":{"id":"ac9b671e4d245756","repo":"grpc/grpc-go","slug":"crl-only-contains-some-certificate-types","errorCode":null,"errorMessage":"CRL only contains some certificate types","messagePattern":"CRL only contains some certificate types","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"security/advancedtls/crl.go","lineNumber":345,"sourceCode":"\t\tcase oidAuthorityKeyIdentifier.Equal(ext.Id):\n\t\t\tvar a authKeyID\n\t\t\tif rest, err := asn1.Unmarshal(ext.Value, &a); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"asn1.Unmarshal failed: %v\", err)\n\t\t\t} else if len(rest) != 0 {\n\t\t\t\treturn nil, errors.New(\"trailing data after AKID extension\")\n\t\t\t}\n\t\t\tcertList.authorityKeyID = a.ID\n\n\t\tcase oidIssuingDistributionPoint.Equal(ext.Id):\n\t\t\tvar dp issuingDistributionPoint\n\t\t\tif rest, err := asn1.Unmarshal(ext.Value, &dp); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"asn1.Unmarshal failed: %v\", err)\n\t\t\t} else if len(rest) != 0 {\n\t\t\t\treturn nil, errors.New(\"trailing data after IssuingDistributionPoint extension\")\n\t\t\t}\n\n\t\t\tif dp.OnlyContainsUserCerts || dp.OnlyContainsCACerts || dp.OnlyContainsAttributeCerts {\n\t\t\t\treturn nil, errors.New(\"CRL only contains some certificate types\")\n\t\t\t}\n\t\t\tif dp.IndirectCRL {\n\t\t\t\treturn nil, errors.New(\"indirect CRLs unsupported\")\n\t\t\t}\n\t\t\tif dp.OnlySomeReasons.BitLength != 0 {\n\t\t\t\treturn nil, errors.New(\"onlySomeReasons unsupported\")\n\t\t\t}\n\n\t\tcase ext.Critical:\n\t\t\treturn nil, fmt.Errorf(\"unsupported critical extension: %v\", ext.Id)\n\t\t}\n\t}\n\n\tif len(certList.authorityKeyID) == 0 {\n\t\treturn nil, errors.New(\"authority key identifier extension missing\")\n\t}\n\treturn certList, nil\n}","sourceCodeStart":327,"sourceCodeEnd":363,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/security/advancedtls/crl.go#L327-L363","documentation":"Returned by parseCRLExtensions (security/advancedtls/crl.go:345) when the Issuing Distribution Point extension sets onlyContainsUserCerts, onlyContainsCACerts, or onlyContainsAttributeCerts. Such a CRL lists revocations for only a subset of certificate types, so the library cannot use it to make a definitive statement about an arbitrary certificate, and rejects it. The check is at lines 344-346.","triggerScenarios":"Configuring a CRL that is scoped (via its IDP) to only user certs, only CA certs, or only attribute certs against a certificate whose type the CRL does not cover; e.g. validating a leaf server certificate against a CA-only CRL.","commonSituations":"Reusing a CA-only CRL for leaf validation; a CA publishing scoped CRLs without providing a full one; mismatched CRL selected by a directory.","solutions":["Use a complete (unscoped) CRL that revokes all certificate types for the relevant CA.","Select the CRL whose IDP scope matches the certificate type you are validating.","Have the CA publish an unscoped base CRL for general validation.","If only scoped CRLs exist, treat revocation as undetermined per your policy rather than feeding the scoped CRL in."],"exampleFix":"// before: validating leaf certs with a CA-only CRL\nverifyOpts := crllib.VerifyOptions{CRLProvider: caOnlyCRLProvider}\n// error: CRL only contains some certificate types\n\n// after: use the full (unscoped) base CRL\nverifyOpts := crllib.VerifyOptions{CRLProvider: fullBaseCRLProvider}","handlingStrategy":"validation","validationCode":"// before configuring, ensure the CRL's IDP is not scoped\nif idp.OnlyContainsUserCerts || idp.OnlyContainsCACerts || idp.OnlyContainsAttributeCerts {\n    return errors.New(\"CRL is type-scoped; use a full base CRL\")\n}","typeGuard":null,"tryCatchPattern":"_, err := crl.Verify(cert, opts)\nif err != nil && strings.Contains(err.Error(), \"only contains some certificate types\") {\n    // select the full base CRL instead\n}","preventionTips":["Use unscoped base CRLs for general validation.","Match the CRL scope to the certificate type you validate.","Have the CA publish a complete CRL alongside scoped ones."],"tags":["go","grpc","security","tls","crl","x509","pkix"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}