grpc/grpc-go · error

CRL only contains some certificate types

Error message

CRL only contains some certificate types

What it means

Returned by parseCRLExtensions (security/advancedtls/crl.go:345) when the Issuing Distribution Point extension sets onlyContainsUserCerts, onlyContainsCACerts, or onlyContainsAttributeCerts. Such a CRL lists revocations for only a subset of certificate types, so the library cannot use it to make a definitive statement about an arbitrary certificate, and rejects it. The check is at lines 344-346.

Source

Thrown at security/advancedtls/crl.go:345

		case oidAuthorityKeyIdentifier.Equal(ext.Id):
			var a authKeyID
			if rest, err := asn1.Unmarshal(ext.Value, &a); err != nil {
				return nil, fmt.Errorf("asn1.Unmarshal failed: %v", err)
			} else if len(rest) != 0 {
				return nil, errors.New("trailing data after AKID extension")
			}
			certList.authorityKeyID = a.ID

		case oidIssuingDistributionPoint.Equal(ext.Id):
			var dp issuingDistributionPoint
			if rest, err := asn1.Unmarshal(ext.Value, &dp); err != nil {
				return nil, fmt.Errorf("asn1.Unmarshal failed: %v", err)
			} else if len(rest) != 0 {
				return nil, errors.New("trailing data after IssuingDistributionPoint extension")
			}

			if dp.OnlyContainsUserCerts || dp.OnlyContainsCACerts || dp.OnlyContainsAttributeCerts {
				return nil, errors.New("CRL only contains some certificate types")
			}
			if dp.IndirectCRL {
				return nil, errors.New("indirect CRLs unsupported")
			}
			if dp.OnlySomeReasons.BitLength != 0 {
				return nil, errors.New("onlySomeReasons unsupported")
			}

		case ext.Critical:
			return nil, fmt.Errorf("unsupported critical extension: %v", ext.Id)
		}
	}

	if len(certList.authorityKeyID) == 0 {
		return nil, errors.New("authority key identifier extension missing")
	}
	return certList, nil
}

View on GitHub (pinned to 03255a9237)

Solutions

1. Use a complete (unscoped) CRL that revokes all certificate types for the relevant CA.
2. Select the CRL whose IDP scope matches the certificate type you are validating.
3. Have the CA publish an unscoped base CRL for general validation.
4. If only scoped CRLs exist, treat revocation as undetermined per your policy rather than feeding the scoped CRL in.

Example fix

// before: validating leaf certs with a CA-only CRL
verifyOpts := crllib.VerifyOptions{CRLProvider: caOnlyCRLProvider}
// error: CRL only contains some certificate types

// after: use the full (unscoped) base CRL
verifyOpts := crllib.VerifyOptions{CRLProvider: fullBaseCRLProvider}

// before configuring, ensure the CRL's IDP is not scoped
if idp.OnlyContainsUserCerts || idp.OnlyContainsCACerts || idp.OnlyContainsAttributeCerts {
    return errors.New("CRL is type-scoped; use a full base CRL")
}

_, err := crl.Verify(cert, opts)
if err != nil && strings.Contains(err.Error(), "only contains some certificate types") {
    // select the full base CRL instead
}

When it happens

Trigger: Configuring a CRL that is scoped (via its IDP) to only user certs, only CA certs, or only attribute certs against a certificate whose type the CRL does not cover; e.g. validating a leaf server certificate against a CA-only CRL.

Common situations: Reusing a CA-only CRL for leaf validation; a CA publishing scoped CRLs without providing a full one; mismatched CRL selected by a directory.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• no DN found in certificate issuer
• trailing data after AKID extension
• trailing data after IssuingDistributionPoint extension
• indirect CRLs unsupported
• pemfile: certificate and key file must be in the same direct

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/ac9b671e4d245756. Report an issue: GitHub.