{"record":{"id":"bc159cf77a66efde","repo":"oven-sh/bun","slug":"unsupported-extension-feature","errorCode":"UNSUPPORTED_EXTENSION_FEATURE","errorMessage":"UNSUPPORTED_EXTENSION_FEATURE","messagePattern":"UNSUPPORTED_EXTENSION_FEATURE","errorType":"error_code","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":211,"sourceCode":"    #[error(\"UNHANDLED_CRITICAL_CRL_EXTENSION\")]\n    UNHANDLED_CRITICAL_CRL_EXTENSION,\n    #[error(\"INVALID_NON_CA\")]\n    INVALID_NON_CA,\n    #[error(\"PROXY_PATH_LENGTH_EXCEEDED\")]\n    PROXY_PATH_LENGTH_EXCEEDED,\n    #[error(\"KEYUSAGE_NO_DIGITAL_SIGNATURE\")]\n    KEYUSAGE_NO_DIGITAL_SIGNATURE,\n    #[error(\"PROXY_CERTIFICATES_NOT_ALLOWED\")]\n    PROXY_CERTIFICATES_NOT_ALLOWED,\n    #[error(\"INVALID_EXTENSION\")]\n    INVALID_EXTENSION,\n    #[error(\"INVALID_POLICY_EXTENSION\")]\n    INVALID_POLICY_EXTENSION,\n    #[error(\"NO_EXPLICIT_POLICY\")]\n    NO_EXPLICIT_POLICY,\n    #[error(\"DIFFERENT_CRL_SCOPE\")]\n    DIFFERENT_CRL_SCOPE,\n    #[error(\"UNSUPPORTED_EXTENSION_FEATURE\")]\n    UNSUPPORTED_EXTENSION_FEATURE,\n    #[error(\"UNNESTED_RESOURCE\")]\n    UNNESTED_RESOURCE,\n    #[error(\"PERMITTED_VIOLATION\")]\n    PERMITTED_VIOLATION,\n    #[error(\"EXCLUDED_VIOLATION\")]\n    EXCLUDED_VIOLATION,\n    #[error(\"SUBTREE_MINMAX\")]\n    SUBTREE_MINMAX,\n    #[error(\"APPLICATION_VERIFICATION\")]\n    APPLICATION_VERIFICATION,\n    #[error(\"UNSUPPORTED_CONSTRAINT_TYPE\")]\n    UNSUPPORTED_CONSTRAINT_TYPE,\n    #[error(\"UNSUPPORTED_CONSTRAINT_SYNTAX\")]\n    UNSUPPORTED_CONSTRAINT_SYNTAX,\n    #[error(\"UNSUPPORTED_NAME_SYNTAX\")]\n    UNSUPPORTED_NAME_SYNTAX,\n    #[error(\"CRL_PATH_VALIDATION_ERROR\")]","sourceCodeStart":193,"sourceCodeEnd":229,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L193-L229","documentation":"CertError::UNSUPPORTED_EXTENSION_FEATURE maps BoringSSL X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE (verify code 45). A certificate/CRL extension uses a feature the verifying implementation does not support during path validation (classic cases: delta CRL indicators, certain policy-constraint processing). Message: \"Unsupported extension feature\".","triggerScenarios":"CRL checking enabled and the CRL carries a deltaCRL indicator or other feature BoringSSL's verifier refuses to process; cert extensions that encode options the path builder explicitly declines (rather than merely ignores).","commonSituations":"PKIs that publish delta CRLs and a verifier that follows CDPs into the delta instead of the base CRL; migration from OpenSSL (which tolerates the feature) to a BoringSSL-based client; appliances generating CRLs with unusual extension combinations.","solutions":["Identify the offending extension: openssl crl -in crl.pem -noout -text (look for Delta CRL Indicator / freshestCRL) or openssl x509 -text","Reissue the CRL/cert without the unsupported feature (publish complete CRLs, drop delta indicators)","Update the CRL distribution setup so verifiers fetch the base CRL, not the delta","If the feature is mandated by your PKI, verify with a stack that supports it and report the incompatibility upstream"],"exampleFix":"# before: publishing a delta CRL at the CDP URL\n[crl_ext]\nissuingDistributionPoint = URI:http://crl.example.com/delta.crl\n\n# after: publish the full CRL at the CDP URL\nissuingDistributionPoint = URI:http://crl.example.com/full.crl","handlingStrategy":"try-catch","validationCode":null,"typeGuard":"export function isUnsupportedExtensionFeature(e): e is Error & { code: \"UNSUPPORTED_EXTENSION_FEATURE\" } {\n  return e instanceof Error && (e as any).code === \"UNSUPPORTED_EXTENSION_FEATURE\";\n}","tryCatchPattern":"try {\n  await fetch(url);\n} catch (e) {\n  if (e?.code === \"UNSUPPORTED_EXTENSION_FEATURE\") {\n    // an extension feature (e.g. delta CRL) is beyond what the verifier supports\n    fallbackToKnownGoodMirror(url);\n  } else throw e;\n}","preventionTips":["Keep CRL/cert extension usage boring: no delta-CRL indicators unless every verifier supports them","Track verifier capabilities (OpenSSL vs BoringSSL feature sets) when choosing PKI features","Test new PKI features against the strictest client that will connect"],"tags":["tls","x509","crl","extensions","pki","fetch","security"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}