{"record":{"id":"e2f2bccb0d8ee363","repo":"apereo/cas","slug":"unknown-crl-reason-code","errorCode":null,"errorMessage":"Unknown CRL reason code.","messagePattern":"Unknown CRL reason code\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/revocation/RevokedCertificateException.java","lineNumber":152,"sourceCode":"         * The AA compromise.\n         */\n        AACompromise;\n\n        /**\n         * Convert code to reason.\n         *\n         * @param code the code\n         * @return the reason\n         */\n        public static Reason fromCode(final int code) {\n            val reasons = Reason.values();\n\n            for (var i = 0; i < reasons.length; i++) {\n                if (i == code) {\n                    return reasons[i];\n                }\n            }\n            throw new IllegalArgumentException(\"Unknown CRL reason code.\");\n        }\n    }\n}\n","sourceCodeStart":134,"sourceCodeEnd":156,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/revocation/RevokedCertificateException.java#L134-L156","documentation":"RevocationReason.fromCode() in RevokedCertificateException maps a numeric X.509 CRL reason code (RFC 5280 enumerated reasons) to its named constant by indexing a reasons array. A code outside the array range throws IllegalArgumentException('Unknown CRL reason code.').","triggerScenarios":"fromCode() is called with a reason code that matches no entry in the reasons array — negative codes, codes beyond the array length, or proprietary/unrecognized codes taken raw from a CRL or upstream revocation checker.","commonSituations":"Custom revocation-checking code passes raw integers from third-party CRL formats; off-by-one translation of RFC reason codes (0=unspecified ... 10=removeFromCRL); older CAS versions encountering reason codes not present in the enum.","solutions":["Validate the code is within the RFC 5280 reason range before calling fromCode() and fall back to 'unspecified' otherwise.","Upgrade CAS so the reasons enum covers all codes your PKI can emit.","Translate raw CRL codes yourself with a bounds-checked wrapper instead of calling fromCode() unchecked.","Inspect the actual code with: openssl crl -in crl.pem -noout -text."],"exampleFix":"// before\nRevocationReason reason = RevocationReason.fromCode(rawCode);\n// after\nRevocationReason reason = (rawCode >= 0 && rawCode <= 10)\n    ? RevocationReason.fromCode(rawCode)\n    : RevocationReason.UNSPECIFIED;","handlingStrategy":"validation","validationCode":"boolean isKnownCrlReasonCode(int code) { return code >= 0 && code <= 10; } // RFC 5280 enumerated reasons","typeGuard":"Integer normalizeReason(Integer code) { return (code != null && code >= 0 && code <= 10) ? code : Integer.valueOf(0); /* unspecified */ }","tryCatchPattern":"try {\n    reason = RevocationReason.fromCode(code);\n} catch (IllegalArgumentException e) {\n    reason = RevocationReason.UNSPECIFIED;\n}","preventionTips":["Bounds-check raw reason codes before mapping.","Keep CAS updated for newly enumerated reason codes.","Log and coalesce unknown codes instead of failing hard.","Test CRL parsing with real PKI-issued CRLs."],"tags":["x509","crl","revocation","enum"],"backgroundTag":"invalid-enum-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}