gchq/CyberChef · error · OperationError

'cRLNumber' CRL entry extension missing 'num' key: ${ext}

Error message

'cRLNumber' CRL entry extension missing 'num' key: ${ext}

What it means

When a CRL extension has extname 'cRLNumber', formatCRLExtensions requires a 'num' key holding the CRL number hex value. If that key is absent the op throws, because it cannot render the number. This is an assertion about jsrsasign's parsed cRLNumber structure.

Source

Thrown at src/core/operations/ParseX509CRL.mjs:187

                    out += `\tkeyid:${colonDelimitedHexFormatString(ext.kid.hex.toUpperCase())}\n`;
                }
                if (Object.hasOwn(ext, "issuer")) {
                    out += `\tDirName:${ext.issuer.str}\n`;
                }
                if (Object.hasOwn(ext, "sn")) {
                    out += `\tserial:${colonDelimitedHexFormatString(ext.sn.hex.toUpperCase())}\n`;
                }
                break;
            case "cRLDistributionPoints":
                out += `X509v3 CRL Distribution Points:\n`;
                ext.array.forEach((distPoint) => {
                    const fullName = `Full Name:\n${formatGeneralNames(distPoint.dpname.full, 4)}`;
                    out += indentString(fullName, 4) + "\n";
                });
                break;
            case "cRLNumber":
                if (!Object.hasOwn(ext, "num")) {
                    throw new OperationError(`'cRLNumber' CRL entry extension missing 'num' key: ${ext}`);
                }
                out += `X509v3 CRL Number:\n\t${ext.num.hex.toUpperCase()}\n`;
                break;
            case "issuerAltName":
                out += `X509v3 Issuer Alternative Name:\n${formatGeneralNames(ext.array, 4)}\n`;
                break;
            default:
                out += `${ext.extname}:\n`;
                out += `\tUnsupported CRL extension. Try openssl CLI.\n`;
                break;
        }
    });

    return indentString(chop(out), indent);
}

/**
 * Format general names array.

View on GitHub (pinned to 4290ea7539)

Solutions

1. Inspect the extension with openssl ('openssl crl -in crl.pem -noout -text') to confirm the cRLNumber is well-formed.
2. Re-download the CRL from the CA distribution point.
3. Verify the jsrsasign version bundled with CyberChef matches expectations.
4. Report the CRL if it is RFC-conformant but the op rejects it — the key check may be too strict.

const crl = new r.X509CRL(input);
const numExt = (crl.getParam().ext || []).find(e => e.extname === "cRLNumber");
if (numExt && !Object.hasOwn(numExt, "num")) {
  throw new Error("cRLNumber extension is missing 'num'");
}

function isValidCrlNumberExtension(ext) {
  return ext.extname !== "cRLNumber" || Object.hasOwn(ext, "num");
}

try {
  return parseX509CRL.run(crlInput, [inputFormat]);
} catch (e) {
  if (e.message.includes("'cRLNumber' CRL entry extension missing 'num'")) {
    // non-standard cRLNumber encoding; validate externally
  }
  throw e;
}

When it happens

Trigger: A CRL with a cRLNumber extension (OID 2.5.29.20) whose parsed object lacks 'num'; a malformed or truncated extension value; jsrsasign version returning a different key name for the CRL number.

Common situations: Parsing CRLs where the cRLNumber criticality/encoding is non-standard; version skew in jsrsasign; corrupt CRL bytes that still partially parse.

Related errors

• CRL entry extension object missing 'extname' key: ${ext}
• 'cRLReason' CRL entry extension missing 'code' key: ${ext}
• failed to format datetime string ${datetime}
• invalid revoked certificate object, missing either serial nu
• PEM footer '${footer}' not found

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/7fe715b356fac877. Report an issue: GitHub.