grpc/grpc-go · error

indirect CRLs unsupported

Error message

indirect CRLs unsupported

What it means

Returned by parseCRLExtensions (security/advancedtls/crl.go:348) when the Issuing Distribution Point extension has indirectCRL set to true. An indirect CRL is one issued by an entity other than the certificate's issuer; this library does not support the indirect-CRL trust chain, so it rejects such CRLs. The check is at lines 347-349.

Source

Thrown at security/advancedtls/crl.go:348

				return nil, fmt.Errorf("asn1.Unmarshal failed: %v", err)
			} else if len(rest) != 0 {
				return nil, errors.New("trailing data after AKID extension")
			}
			certList.authorityKeyID = a.ID

		case oidIssuingDistributionPoint.Equal(ext.Id):
			var dp issuingDistributionPoint
			if rest, err := asn1.Unmarshal(ext.Value, &dp); err != nil {
				return nil, fmt.Errorf("asn1.Unmarshal failed: %v", err)
			} else if len(rest) != 0 {
				return nil, errors.New("trailing data after IssuingDistributionPoint extension")
			}

			if dp.OnlyContainsUserCerts || dp.OnlyContainsCACerts || dp.OnlyContainsAttributeCerts {
				return nil, errors.New("CRL only contains some certificate types")
			}
			if dp.IndirectCRL {
				return nil, errors.New("indirect CRLs unsupported")
			}
			if dp.OnlySomeReasons.BitLength != 0 {
				return nil, errors.New("onlySomeReasons unsupported")
			}

		case ext.Critical:
			return nil, fmt.Errorf("unsupported critical extension: %v", ext.Id)
		}
	}

	if len(certList.authorityKeyID) == 0 {
		return nil, errors.New("authority key identifier extension missing")
	}
	return certList, nil
}

func verifyCRL(crl *CRL, chain []*x509.Certificate) error {
	// RFC5280, 6.3.3 (f) Obtain and validate the certification path for the issuer of the complete CRL

View on GitHub (pinned to 03255a9237)

Solutions

1. Use a direct CRL issued by the same CA that issued the certificates you are validating.
2. Obtain the direct CRL from the certificate's CRL Distribution Points extension rather than an alternate source.
3. If your PKI only offers indirect CRLs, reconfigure the CA to publish a direct base CRL, or disable CRL checking and use OCSP instead.
4. Verify the CRL's IDP extension does not set indirectCRL before configuring it.

Example fix

// before: indirect CRL from a delegated issuer
verifyOpts := crllib.VerifyOptions{CRLProvider: indirectCRLProvider}
// error: indirect CRLs unsupported

// after: direct CRL from the issuing CA
verifyOpts := crllib.VerifyOptions{CRLProvider: directCRLProvider}

if idp.IndirectCRL {
    return errors.New("indirect CRL not supported; provide a direct CRL")
}

_, err := crl.Verify(cert, opts)
if err != nil && strings.Contains(err.Error(), "indirect CRLs unsupported") {
    // fetch a direct CRL from the cert's CRLDistributionPoints
}

When it happens

Trigger: Configuring a CRL that was issued by a delegated/CRL issuer distinct from the CA that issued the certificates being checked (indirectCRL=true in its IDP extension).

Common situations: A PKI that delegates CRL issuance to a dedicated CRL issuer; enterprise CA setups using indirect CRLs for separation of duties; pulling the wrong (indirect) CRL from a CRL distribution point.

Related errors

• no DN found in certificate issuer
• trailing data after AKID extension
• trailing data after IssuingDistributionPoint extension
• CRL only contains some certificate types
• pemfile: certificate and key file must be in the same direct

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/bf2de4de755a1766. Report an issue: GitHub.