{"record":{"id":"c5327cf408be731b","repo":"apereo/cas","slug":"all-crl-entries-have-been-revoked-rejecting-the-f","errorCode":null,"errorMessage":"All CRL entries have been revoked. Rejecting the first entry [{}]","messagePattern":"All CRL entries have been revoked\\. Rejecting the first entry \\[(.+?)\\]","errorType":"exception","errorClass":"RevokedCertificateException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/revocation/checker/AbstractCRLRevocationChecker.java","lineNumber":88,"sourceCode":"        val expiredCrls = new ArrayList<X509CRL>(crls.size());\n        crls.stream().filter(CertUtils::isExpired).forEach(crl -> {\n            LOGGER.warn(\"CRL data expired on [{}]\", crl.getNextUpdate());\n            expiredCrls.add(crl);\n        });\n\n        if (crls.size() == expiredCrls.size()) {\n            LOGGER.warn(\"All CRLs retrieved have expired. Applying CRL expiration policy...\");\n            for (val crl : expiredCrls) {\n                this.expiredCRLPolicy.apply(crl);\n            }\n        } else {\n            crls.removeAll(expiredCrls);\n            LOGGER.debug(\"Valid CRLs [{}] found that are not expired yet\", crls);\n\n            val revokedCrls = crls.stream().map(crl -> crl.getRevokedCertificate(cert)).filter(Objects::nonNull).toList();\n            if (revokedCrls.size() == crls.size()) {\n                val entry = revokedCrls.getFirst();\n                LOGGER.warn(\"All CRL entries have been revoked. Rejecting the first entry [{}]\", entry);\n                throw new RevokedCertificateException(entry);\n            }\n        }\n    }\n\n    /**\n     * Records the addition of a new CRL entry.\n     *\n     * @param id  the id of the entry to keep track of\n     * @param crl new CRL entry\n     * @return true if the entry was added successfully.\n     * @since 4.1\n     */\n    protected abstract boolean addCRL(Object id, X509CRL crl);\n\n    /**\n     * Gets the collection of CRLs for the given certificate.\n     *","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/revocation/checker/AbstractCRLRevocationChecker.java#L70-L106","documentation":"Thrown as RevokedCertificateException when every non-expired CRL retrieved contains a revocation entry for the certificate (revokedCrls.size() == crls.size()). CAS rejects the certificate: the first matching revoked entry is logged and RevokedCertificateException(entry) is thrown, failing authentication for that X.509 credential.","triggerScenarios":"AbstractCRLRevocationChecker.check() finds the certificate's serial number listed in each valid CRL — i.e. the cert was revoked by its CA (compromise, key loss, deliberate revocation).","commonSituations":"User presents a genuinely revoked client certificate after losing a smart card or leaving the organization; a test/old certificate revoked by the CA is still deployed in a keystore; multiple CRLs (e.g. from cascading CAs) all list the serial.","solutions":["Treat this as correct behavior: the certificate IS revoked; issue a new certificate for the user.","Verify the revocation is legitimate by checking the CRL entry's revocation date and reason with 'openssl crl -in ca.crl -text'.","Remove the revoked certificate from client keystores/browsers and redeploy the replacement cert.","If revocation was in error, have the CA un-revoke/reissue — do not weaken the revocation policy."],"exampleFix":"// before: still authenticating with old revoked cert\nkeytool -list -v -keystore client.p12\n// after: replace with newly issued certificate\nkeytool -importkeystore -srckeystore new-client.p12 -destkeystore client.p12","handlingStrategy":"try-catch","validationCode":"X509CRL crl = /* fetched */;\nif (crl != null && crl.isRevoked(cert)) {\n    throw new RevokedCertificateException(crl.getRevokedCertificate(cert));\n}","typeGuard":null,"tryCatchPattern":"try {\n    checker.check(cert);\n} catch (RevokedCertificateException e) {\n    LOGGER.warn(\"Certificate [{}] is revoked as of [{}]\",\n        cert.getSerialNumber(), e.getMessage());\n    throw e; // do not swallow: reject authentication\n}","preventionTips":["Never accept an exception-swallowing wrapper around revocation checking.","Inventory deployed client certificates and cross-check serials against current CRLs before rollout.","Have a documented cert-reissuance process for revoked credentials.","Keep revocation policies strict (deny); monitor RevokedCertificateException rates as a security signal."],"tags":["x509","crl","revoked-certificate","revocation"],"backgroundTag":"certificate-revoked","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}