{"record":{"id":"cd6bc715a412ee3c","repo":"oven-sh/bun","slug":"keyusage-no-crl-sign","errorCode":"KEYUSAGE_NO_CRL_SIGN","errorMessage":"KEYUSAGE_NO_CRL_SIGN","messagePattern":"KEYUSAGE_NO_CRL_SIGN","errorType":"error_code","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":191,"sourceCode":"    #[error(\"INVALID_PURPOSE\")]\n    INVALID_PURPOSE,\n    #[error(\"CERT_UNTRUSTED\")]\n    CERT_UNTRUSTED,\n    #[error(\"CERT_REJECTED\")]\n    CERT_REJECTED,\n    #[error(\"SUBJECT_ISSUER_MISMATCH\")]\n    SUBJECT_ISSUER_MISMATCH,\n    #[error(\"AKID_SKID_MISMATCH\")]\n    AKID_SKID_MISMATCH,\n    #[error(\"AKID_ISSUER_SERIAL_MISMATCH\")]\n    AKID_ISSUER_SERIAL_MISMATCH,\n    #[error(\"KEYUSAGE_NO_CERTSIGN\")]\n    KEYUSAGE_NO_CERTSIGN,\n    #[error(\"UNABLE_TO_GET_CRL_ISSUER\")]\n    UNABLE_TO_GET_CRL_ISSUER,\n    #[error(\"UNHANDLED_CRITICAL_EXTENSION\")]\n    UNHANDLED_CRITICAL_EXTENSION,\n    #[error(\"KEYUSAGE_NO_CRL_SIGN\")]\n    KEYUSAGE_NO_CRL_SIGN,\n    #[error(\"UNHANDLED_CRITICAL_CRL_EXTENSION\")]\n    UNHANDLED_CRITICAL_CRL_EXTENSION,\n    #[error(\"INVALID_NON_CA\")]\n    INVALID_NON_CA,\n    #[error(\"PROXY_PATH_LENGTH_EXCEEDED\")]\n    PROXY_PATH_LENGTH_EXCEEDED,\n    #[error(\"KEYUSAGE_NO_DIGITAL_SIGNATURE\")]\n    KEYUSAGE_NO_DIGITAL_SIGNATURE,\n    #[error(\"PROXY_CERTIFICATES_NOT_ALLOWED\")]\n    PROXY_CERTIFICATES_NOT_ALLOWED,\n    #[error(\"INVALID_EXTENSION\")]\n    INVALID_EXTENSION,\n    #[error(\"INVALID_POLICY_EXTENSION\")]\n    INVALID_POLICY_EXTENSION,\n    #[error(\"NO_EXPLICIT_POLICY\")]\n    NO_EXPLICIT_POLICY,\n    #[error(\"DIFFERENT_CRL_SCOPE\")]","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L173-L209","documentation":"CertError::KEYUSAGE_NO_CRL_SIGN maps BoringSSL X509 verify code 35 (X509_V_ERR_KEYUSAGE_NO_CRL_SIGN) via get_cert_error_from_no() in src/http/lib.rs:1554. During CRL validation, the certificate that signed the CRL has a keyUsage without the cRLSign bit, so it is not authorized to sign CRLs and revocation checking fails. JS error.code is KEYUSAGE_NO_CRL_SIGN with message 'key usage does not include CRL signing' (FetchTasklet.rs:1487).","triggerScenarios":"CRL-based revocation checking encounters a CRL whose signer certificate's keyUsage lacks cRLSign (e.g., a CA issued with only keyCertSign, or a delegated signer without cRLSign).","commonSituations":"Private PKI CA certs generated with keyUsage=keyCertSign only, CA templates copied minus the cRLSign bit, delegated CRL signers misissued after a template change.","solutions":["Check the CA cert: openssl x509 -in ca.pem -noout -text | grep -A1 'Key Usage' — needs 'CRL Sign'","Reissue the CA/crl-signer with keyUsage=critical,keyCertSign,cRLSign","Regenerate and republish CRLs signed by the corrected cert","Alternatively stop enforcing CRLs on that path if revocation is handled out-of-band"],"exampleFix":"# before\n-addext 'keyUsage=critical,keyCertSign'\n# after\n-addext 'keyUsage=critical,keyCertSign,cRLSign'\n# then re-sign the CRL\nopenssl ca -gencrl -keyfile ca-key.pem -cert ca.pem -out ca.crl.pem","handlingStrategy":"validation","validationCode":"import { execSync } from \"node:child_process\";\nconst text = execSync(\"openssl x509 -in ca.pem -noout -text\").toString();\nif (/CRL Sign/.test(text) === false) {\n  throw new Error(\"CA keyUsage lacks cRLSign — CRL validation will fail KEYUSAGE_NO_CRL_SIGN\");\n}","typeGuard":"function isNoCrlSign(e: unknown): e is Error & { code: \"KEYUSAGE_NO_CRL_SIGN\" } {\n  return e instanceof Error && (e as any).code === \"KEYUSAGE_NO_CRL_SIGN\";\n}","tryCatchPattern":"try { await fetch(url); } catch (e) { if (isNoCrlSign(e)) { alertPkiTeam(\"CRL signer lacks cRLSign\"); return fetchWithoutCrl(url); } throw e; }","preventionTips":["Issue CA/crl-signer certs with both keyCertSign and cRLSign","Regenerate CRLs after fixing signer keyUsage","Skip CRL distribution on paths that do not enforce revocation"],"tags":["tls","certificate","crl","keyusage","pki"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}