{"record":{"id":"bf2de4de755a1766","repo":"grpc/grpc-go","slug":"indirect-crls-unsupported","errorCode":null,"errorMessage":"indirect CRLs unsupported","messagePattern":"indirect CRLs unsupported","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"security/advancedtls/crl.go","lineNumber":348,"sourceCode":"\t\t\t\treturn nil, fmt.Errorf(\"asn1.Unmarshal failed: %v\", err)\n\t\t\t} else if len(rest) != 0 {\n\t\t\t\treturn nil, errors.New(\"trailing data after AKID extension\")\n\t\t\t}\n\t\t\tcertList.authorityKeyID = a.ID\n\n\t\tcase oidIssuingDistributionPoint.Equal(ext.Id):\n\t\t\tvar dp issuingDistributionPoint\n\t\t\tif rest, err := asn1.Unmarshal(ext.Value, &dp); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"asn1.Unmarshal failed: %v\", err)\n\t\t\t} else if len(rest) != 0 {\n\t\t\t\treturn nil, errors.New(\"trailing data after IssuingDistributionPoint extension\")\n\t\t\t}\n\n\t\t\tif dp.OnlyContainsUserCerts || dp.OnlyContainsCACerts || dp.OnlyContainsAttributeCerts {\n\t\t\t\treturn nil, errors.New(\"CRL only contains some certificate types\")\n\t\t\t}\n\t\t\tif dp.IndirectCRL {\n\t\t\t\treturn nil, errors.New(\"indirect CRLs unsupported\")\n\t\t\t}\n\t\t\tif dp.OnlySomeReasons.BitLength != 0 {\n\t\t\t\treturn nil, errors.New(\"onlySomeReasons unsupported\")\n\t\t\t}\n\n\t\tcase ext.Critical:\n\t\t\treturn nil, fmt.Errorf(\"unsupported critical extension: %v\", ext.Id)\n\t\t}\n\t}\n\n\tif len(certList.authorityKeyID) == 0 {\n\t\treturn nil, errors.New(\"authority key identifier extension missing\")\n\t}\n\treturn certList, nil\n}\n\nfunc verifyCRL(crl *CRL, chain []*x509.Certificate) error {\n\t// RFC5280, 6.3.3 (f) Obtain and validate the certification path for the issuer of the complete CRL","sourceCodeStart":330,"sourceCodeEnd":366,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/security/advancedtls/crl.go#L330-L366","documentation":"Returned by parseCRLExtensions (security/advancedtls/crl.go:348) when the Issuing Distribution Point extension has indirectCRL set to true. An indirect CRL is one issued by an entity other than the certificate's issuer; this library does not support the indirect-CRL trust chain, so it rejects such CRLs. The check is at lines 347-349.","triggerScenarios":"Configuring a CRL that was issued by a delegated/CRL issuer distinct from the CA that issued the certificates being checked (indirectCRL=true in its IDP extension).","commonSituations":"A PKI that delegates CRL issuance to a dedicated CRL issuer; enterprise CA setups using indirect CRLs for separation of duties; pulling the wrong (indirect) CRL from a CRL distribution point.","solutions":["Use a direct CRL issued by the same CA that issued the certificates you are validating.","Obtain the direct CRL from the certificate's CRL Distribution Points extension rather than an alternate source.","If your PKI only offers indirect CRLs, reconfigure the CA to publish a direct base CRL, or disable CRL checking and use OCSP instead.","Verify the CRL's IDP extension does not set indirectCRL before configuring it."],"exampleFix":"// before: indirect CRL from a delegated issuer\nverifyOpts := crllib.VerifyOptions{CRLProvider: indirectCRLProvider}\n// error: indirect CRLs unsupported\n\n// after: direct CRL from the issuing CA\nverifyOpts := crllib.VerifyOptions{CRLProvider: directCRLProvider}","handlingStrategy":"validation","validationCode":"if idp.IndirectCRL {\n    return errors.New(\"indirect CRL not supported; provide a direct CRL\")\n}","typeGuard":null,"tryCatchPattern":"_, err := crl.Verify(cert, opts)\nif err != nil && strings.Contains(err.Error(), \"indirect CRLs unsupported\") {\n    // fetch a direct CRL from the cert's CRLDistributionPoints\n}","preventionTips":["Use direct CRLs from the cert's own CA; read CRLDistributionPoints on the certificate.","Avoid delegated/CRL-issuer PKI designs with this library, or use OCSP instead.","Check the IDP extension does not set indirectCRL before configuring."],"tags":["go","grpc","security","tls","crl","x509","pkix"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}