{"record":{"id":"f85f13b40ec0d4cc","repo":"apereo/cas","slug":"could-not-decode-provided-crl-file","errorCode":null,"errorMessage":"Could not decode provided CRL file ","messagePattern":"Could not decode provided CRL file ","errorType":"exception","errorClass":"BeanCreationException","httpStatus":null,"severity":"critical","filePath":"support/cas-server-support-saml-core-api/src/main/java/org/apereo/cas/support/saml/util/credential/BasicX509CredentialFactoryBean.java","lineNumber":175,"sourceCode":"            throw new BeanCreationException(\"Could not decode provided KeyFile \" + privateKeyResource.getDescription(), e);\n        }\n    }\n\n    @Override\n    public boolean isSingleton() {\n        return true;\n    }\n\n    private List<X509CRL> getCRLs() {\n        if (null == crlResources) {\n            return null;\n        }\n        val crls = new LazyList<X509CRL>();\n        for (val crl : crlResources) {\n            try (val is = crl.getInputStream()) {\n                crls.addAll(X509Support.decodeCRLs(is));\n            } catch (final Exception e) {\n                throw new BeanCreationException(\"Could not decode provided CRL file \" + crl.getDescription(), e);\n            }\n        }\n        return crls;\n    }\n}\n","sourceCodeStart":157,"sourceCodeEnd":181,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-core-api/src/main/java/org/apereo/cas/support/saml/util/credential/BasicX509CredentialFactoryBean.java#L157-L181","documentation":"BasicX509CredentialFactoryBean.getCRLs() reads each configured CRL resource and decodes it via X509Support.decodeCRLs(). If the stream cannot be opened or the bytes are not a parseable X.509 CRL (CRLDEF/PEM/DER), it wraps the failure in a Spring BeanCreationException, aborting creation of the credential bean.","triggerScenarios":"crlResources contains a resource whose getInputStream() fails (file missing, unreadable, bad URL) or whose content is not a valid CRL that X509Support.decodeCRLs() can parse.","commonSituations":"cas.authn.saml.sp.crlResource-style config pointing at a typo'd path, an empty or HTML error page downloaded instead of a CRL, a PEM file with wrong headers, or a CRL file that expired/was replaced by corrupt content.","solutions":["Verify every configured CRL resource path/URL resolves and is readable by the CAS process (test with cat/curl using the exact configured value).","Validate the file is a real CRL: run `openssl crl -in crl.pem -noout -text` (or `-inform DER`) and fix the format/encoding if it fails.","If fetched over HTTP, confirm the URL returns the CRL itself, not an HTML error page; re-download from the issuer.","Catch the BeanCreationException during startup and correct the resource; the bean will keep failing until the CRL resource is valid."],"exampleFix":"// before\ncas.authn.saml.sp.crl-resource=file:/etc/cas/crls/old-ca.crl   // file missing/corrupt\n\n// after\n# validate first: openssl crl -in /etc/cas/crls/ca.crl -noout -text\ncas.authn.saml.sp.crl-resource=file:/etc/cas/crls/ca.crl","handlingStrategy":"validation","validationCode":"// before wiring the credential bean\nfor (Resource crl : crlResources) {\n    try (var is = crl.getInputStream()) {\n        var crls = X509Support.decodeCRLs(is);\n        if (crls.isEmpty()) throw new IllegalStateException(\"No CRLs decoded from \" + crl.getDescription());\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    credentialFactoryBean.getObject();\n} catch (BeanCreationException e) {\n    logger.error(\"CRL resource invalid: {}\", e.getCause() != null ? e.getCause().getMessage() : e.getMessage());\n}","preventionTips":["Validate each CRL with `openssl crl -noout -text` before deploying it.","Automate CRL downloads with checksum verification and atomic file replacement.","Ensure the CAS process user has read access to all CRL paths."],"tags":["saml","x509","crl","bean-creation","config"],"backgroundTag":"file-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}