{"record":{"id":"bd1893e6e1ea6e06","repo":"gchq/CyberChef","slug":"invalid-revoked-certificate-object-missing-either","errorCode":null,"errorMessage":"invalid revoked certificate object, missing either serial number or date","messagePattern":"invalid revoked certificate object, missing either serial number or date","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/ParseX509CRL.mjs","lineNumber":271,"sourceCode":"    return chop(hexString.replace(/(..)/g, \"$&:\"));\n}\n\n/**\n * Format revoked certificates array\n * @param {r.RevokedCertificate[] | null} revokedCertificates\n * @param {Number} indent\n * @returns Multi-line formatted string output of revoked certificates array\n */\nfunction formatRevokedCertificates(revokedCertificates, indent) {\n    if (Array.isArray(revokedCertificates) === false || revokedCertificates.length === 0) {\n        return indentString(\"No Revoked Certificates.\", indent);\n    }\n\n    let out=``;\n\n    revokedCertificates.forEach((revCert) => {\n        if (!Object.hasOwn(revCert, \"sn\") || !Object.hasOwn(revCert, \"date\")) {\n            throw new OperationError(\"invalid revoked certificate object, missing either serial number or date\");\n        }\n\n        out += `Serial Number: ${revCert.sn.hex.toUpperCase()}\n    Revocation Date: ${generalizedDateTimeToUTC(revCert.date)}\\n`;\n        if (Object.hasOwn(revCert, \"ext\") && Array.isArray(revCert.ext) && revCert.ext.length !== 0) {\n            out += `\\tCRL entry extensions:\\n${indentString(formatCRLEntryExtensions(revCert.ext), 2*indent)}\\n`;\n        }\n    });\n\n    return indentString(chop(out), indent);\n}\n\n/**\n * Format CRL entry extensions.\n * @param {Object[]} exts\n * @returns Formatted multi-line string describing CRL entry extensions.\n */\nfunction formatCRLEntryExtensions(exts) {","sourceCodeStart":253,"sourceCodeEnd":289,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/ParseX509CRL.mjs#L253-L289","documentation":"formatRevokedCertificates iterates crl.getRevCertArray() and requires every revoked certificate entry to have both 'sn' (serial number) and 'date' (revocation date). If either is missing the entry cannot be rendered meaningfully, so the op throws. This guards the parser's expectation of jsrsasign's revoked-cert object shape.","triggerScenarios":"A CRL with a revoked-cert entry missing the serial number or revocation date; malformed revoked-cert sequence; jsrsasign returning a partial object for an unusual entry encoding.","commonSituations":"Parsing a corrupt or truncated CRL; CRLs from non-conformant CAs; version skew in jsrsasign's revoked-cert representation.","solutions":["Validate the CRL with openssl to confirm every revoked entry has a serial and date.","Re-fetch the CRL from the CA's distribution point.","Check the bundled jsrsasign version for revoked-cert object changes.","If the CRL is valid, report the entry shape so the op can tolerate it."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const crl = new r.X509CRL(input);\nconst revoked = crl.getRevCertArray() || [];\nif (revoked.some(rc => !Object.hasOwn(rc, \"sn\") || !Object.hasOwn(rc, \"date\"))) {\n  throw new Error(\"A revoked-cert entry is missing 'sn' or 'date'\");\n}","typeGuard":"function revokedCertsHaveSnAndDate(revoked) {\n  return Array.isArray(revoked) && revoked.every(rc => Object.hasOwn(rc, \"sn\") && Object.hasOwn(rc, \"date\"));\n}","tryCatchPattern":"try {\n  return parseX509CRL.run(crlInput, [inputFormat]);\n} catch (e) {\n  if (e.message === \"invalid revoked certificate object, missing either serial number or date\") {\n    // a revoked entry is malformed; validate the CRL with openssl\n  }\n  throw e;\n}","preventionTips":["Validate CRLs with openssl crl -text.","Keep jsrsasign version aligned.","Re-fetch CRLs from the CA."],"tags":["crypto","x509","crl","parsing","revoked-certificates"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}