{"record":{"id":"ba17047667eaafb2","repo":"grpc/grpc-go","slug":"no-dn-found-in-certificate-issuer","errorCode":null,"errorMessage":"no DN found in certificate issuer","messagePattern":"no DN found in certificate issuer","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"security/advancedtls/crl.go","lineNumber":284,"sourceCode":"\t\t// otherName                       [0]     OtherName,\n\t\t// rfc822Name                      [1]     IA5String,\n\t\t// dNSName                         [2]     IA5String,\n\t\t// x400Address                     [3]     ORAddress,\n\t\t// directoryName                   [4]     Name,\n\t\t// ediPartyName                    [5]     EDIPartyName,\n\t\t// uniformResourceIdentifier       [6]     IA5String,\n\t\t// iPAddress                       [7]     OCTET STRING,\n\t\t// registeredID                    [8]     OBJECT IDENTIFIER }\n\t\tif generalName.Tag == tagDirectoryName {\n\t\t\treturn generalName.Bytes, nil\n\t\t}\n\t}\n\t// Conforming CRL issuers MUST include in this extension the\n\t// distinguished name (DN) from the issuer field of the certificate that\n\t// corresponds to this CRL entry.\n\t// If we couldn't get a directoryName, we can't reason about this file so cert status is\n\t// RevocationUndetermined.\n\treturn nil, errors.New(\"no DN found in certificate issuer\")\n}\n\n// RFC 5280,  4.2.1.1\ntype authKeyID struct {\n\tID []byte `asn1:\"optional,tag:0\"`\n}\n\n// RFC5280, 5.2.5\n// id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-ce 28 }\n\n// IssuingDistributionPoint ::= SEQUENCE {\n// \t\tdistributionPoint          [0] DistributionPointName OPTIONAL,\n// \t\tonlyContainsUserCerts      [1] BOOLEAN DEFAULT FALSE,\n// \t\tonlyContainsCACerts        [2] BOOLEAN DEFAULT FALSE,\n// \t\tonlySomeReasons            [3] ReasonFlags OPTIONAL,\n// \t\tindirectCRL                [4] BOOLEAN DEFAULT FALSE,\n// \t\tonlyContainsAttributeCerts [5] BOOLEAN DEFAULT FALSE }\n","sourceCodeStart":266,"sourceCodeEnd":302,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/security/advancedtls/crl.go#L266-L302","documentation":"Returned by parseCertIssuerExt (security/advancedtls/crl.go:284) when parsing a CRL's Certificate Issuer extension and none of the GeneralName entries is a directoryName ([4]) form. The CRL revocation logic compares the issuer DN against the certificate, so without a DN it cannot reason about the entry and returns this error. The result surfaces as a RevocationUndetermined status.","triggerScenarios":"A CRL (typically an indirect CRL) whose Certificate Issuer extension uses only non-DN name forms such as a dNSName, uniformResourceIdentifier, or iPAddress; a malformed CRL with an empty issuer name list.","commonSituations":"Using an indirect CRL issued by a non-CA; a CA generating CRLs with non-standard issuer name encodings; corrupted or spec-non-compliant CRL files fetched from a CDN.","solutions":["Use a direct CRL (issued by the certificate's own CA) whose issuer is a proper DN, avoiding reliance on the Certificate Issuer extension.","Regenerate the CRL so the issuer extension includes a directoryName GeneralName.","Fetch the CRL from the authoritative distribution point rather than a possibly-altered mirror.","If unavoidable, treat revocation as undetermined and fail closed/open per your security policy."],"exampleFix":"// before: relying on an indirect CRL with URI-only issuer\n// crlHelper.Verify -> error \"no DN found in certificate issuer\"\n\n// after: use the direct CRL published by the issuing CA\nverifyOpts := crllib.VerifyOptions{CRLProvider: directCRLProvider}","handlingStrategy":"validation","validationCode":"func hasDirectoryIssuer(exts []pkix.Extension) bool {\n    for _, e := range exts {\n        if oidCertIssuer.Equal(e.Id) && /* decode yields a directoryName */ true {\n            return true\n        }\n    }\n    return false\n}","typeGuard":null,"tryCatchPattern":"status, err := crl.Verify(cert, opts)\nif err != nil && strings.Contains(err.Error(), \"no DN found\") {\n    // switch to a direct CRL or fail closed\n}","preventionTips":["Prefer direct CRLs issued by the cert's own CA.","Validate CRL extensions with openssl before deployment.","Treat undetermined revocation according to your security posture."],"tags":["go","grpc","security","tls","crl","x509","pkix"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}