{"record":{"id":"f3191d1a6e7fb209","repo":"oven-sh/bun","slug":"different-crl-scope","errorCode":"DIFFERENT_CRL_SCOPE","errorMessage":"DIFFERENT_CRL_SCOPE","messagePattern":"DIFFERENT_CRL_SCOPE","errorType":"error_code","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":209,"sourceCode":"    #[error(\"KEYUSAGE_NO_CRL_SIGN\")]\n    KEYUSAGE_NO_CRL_SIGN,\n    #[error(\"UNHANDLED_CRITICAL_CRL_EXTENSION\")]\n    UNHANDLED_CRITICAL_CRL_EXTENSION,\n    #[error(\"INVALID_NON_CA\")]\n    INVALID_NON_CA,\n    #[error(\"PROXY_PATH_LENGTH_EXCEEDED\")]\n    PROXY_PATH_LENGTH_EXCEEDED,\n    #[error(\"KEYUSAGE_NO_DIGITAL_SIGNATURE\")]\n    KEYUSAGE_NO_DIGITAL_SIGNATURE,\n    #[error(\"PROXY_CERTIFICATES_NOT_ALLOWED\")]\n    PROXY_CERTIFICATES_NOT_ALLOWED,\n    #[error(\"INVALID_EXTENSION\")]\n    INVALID_EXTENSION,\n    #[error(\"INVALID_POLICY_EXTENSION\")]\n    INVALID_POLICY_EXTENSION,\n    #[error(\"NO_EXPLICIT_POLICY\")]\n    NO_EXPLICIT_POLICY,\n    #[error(\"DIFFERENT_CRL_SCOPE\")]\n    DIFFERENT_CRL_SCOPE,\n    #[error(\"UNSUPPORTED_EXTENSION_FEATURE\")]\n    UNSUPPORTED_EXTENSION_FEATURE,\n    #[error(\"UNNESTED_RESOURCE\")]\n    UNNESTED_RESOURCE,\n    #[error(\"PERMITTED_VIOLATION\")]\n    PERMITTED_VIOLATION,\n    #[error(\"EXCLUDED_VIOLATION\")]\n    EXCLUDED_VIOLATION,\n    #[error(\"SUBTREE_MINMAX\")]\n    SUBTREE_MINMAX,\n    #[error(\"APPLICATION_VERIFICATION\")]\n    APPLICATION_VERIFICATION,\n    #[error(\"UNSUPPORTED_CONSTRAINT_TYPE\")]\n    UNSUPPORTED_CONSTRAINT_TYPE,\n    #[error(\"UNSUPPORTED_CONSTRAINT_SYNTAX\")]\n    UNSUPPORTED_CONSTRAINT_SYNTAX,\n    #[error(\"UNSUPPORTED_NAME_SYNTAX\")]","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L191-L227","documentation":"CertError::DIFFERENT_CRL_SCOPE maps BoringSSL X509_V_ERR_DIFFERENT_CRL_SCOPE (verify code 44). With CRL checking enabled, the CRL located for an issuer does not cover the certificate being checked: its issuingDistributionPoint extension scopes it elsewhere (indirect CRL, delta CRL, or only-CA/only-user attributes mismatch). Message: \"Different CRL scope\".","triggerScenarios":"Verification with X509_V_FLAG_CRL_CHECK(_ALL) where the fetched CRL's idp extension excludes the leaf (e.g. CRL marked onlyContainsCACerts=true used to check a leaf, or a CRL issued by an indirect CRL issuer for a different partition).","commonSituations":"Enterprise PKIs with partitioned/indirect CRLs; a CDN or hosting layer serving the wrong CRL at the CDP URL; CRL generation templates that accidentally set scope attributes; test environments where the CRL was regenerated for a different CA partition.","solutions":["Inspect the CRL scope: openssl crl -in crl.pem -noout -text and check the Issuing Distribution Point extension","Regenerate the CRL without restrictive scope flags (no onlyContainsCACerts/onlyContainsUserCerts for a full CRL) or publish the CRL for the correct partition","Fix the CRL Distribution Point URL in the cert to point at the CRL that actually covers it","If revocation is handled by OCSP instead, drop CRL checking on the verifier"],"exampleFix":"# before: CRL scoped to CAs only, used against a leaf\nopenssl ca -gencrl -crlexts crl_ext ...\n[crl_ext]\nissuingDistributionPoint = critical, onlycontainscacerts, URI:http://crl.example.com/ca.crl\n\n# after: full-scope CRL\n[crl_ext]\nissuingDistributionPoint = URI:http://crl.example.com/ca.crl","handlingStrategy":"try-catch","validationCode":null,"typeGuard":"export function isDifferentCrlScope(e): e is Error & { code: \"DIFFERENT_CRL_SCOPE\" } {\n  return e instanceof Error && (e as any).code === \"DIFFERENT_CRL_SCOPE\";\n}","tryCatchPattern":"try {\n  await fetch(url);\n} catch (e) {\n  if (e?.code === \"DIFFERENT_CRL_SCOPE\") {\n    // CRL fetched for the issuer doesn't cover this cert - fix CRL scope or CDP URL\n    openPkiTicket(\"crl-scope\", url);\n  } else throw e;\n}","preventionTips":["Publish full-scope CRLs at the URLs named in CRL Distribution Points","After any CRL partitioning change, test with openssl verify -crl_check from a clean host","Prefer OCSP stapling where possible to sidestep CRL scoping entirely"],"tags":["tls","x509","crl","revocation","pki","fetch","security"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}