grpc/grpc-go · error

onlySomeReasons unsupported

Error message

onlySomeReasons unsupported

What it means

Thrown by gRPC's advancedtls CRL validator inside parseCRLExtensions when a CRL's IssuingDistributionPoint extension carries a non-empty onlySomeReasons bitstring. Such a CRL scopes its revocation entries to specific reason codes (e.g. keyCompromise), and gRPC intentionally rejects reason-scoped CRLs because its validation model assumes a complete, unscoped CRL. The check lives at crl.go:350 and is part of a set of guards that only accept plain base CRLs.

Source

Thrown at security/advancedtls/crl.go:351

			}
			certList.authorityKeyID = a.ID

		case oidIssuingDistributionPoint.Equal(ext.Id):
			var dp issuingDistributionPoint
			if rest, err := asn1.Unmarshal(ext.Value, &dp); err != nil {
				return nil, fmt.Errorf("asn1.Unmarshal failed: %v", err)
			} else if len(rest) != 0 {
				return nil, errors.New("trailing data after IssuingDistributionPoint extension")
			}

			if dp.OnlyContainsUserCerts || dp.OnlyContainsCACerts || dp.OnlyContainsAttributeCerts {
				return nil, errors.New("CRL only contains some certificate types")
			}
			if dp.IndirectCRL {
				return nil, errors.New("indirect CRLs unsupported")
			}
			if dp.OnlySomeReasons.BitLength != 0 {
				return nil, errors.New("onlySomeReasons unsupported")
			}

		case ext.Critical:
			return nil, fmt.Errorf("unsupported critical extension: %v", ext.Id)
		}
	}

	if len(certList.authorityKeyID) == 0 {
		return nil, errors.New("authority key identifier extension missing")
	}
	return certList, nil
}

func verifyCRL(crl *CRL, chain []*x509.Certificate) error {
	// RFC5280, 6.3.3 (f) Obtain and validate the certification path for the issuer of the complete CRL
	// We intentionally limit our CRLs to be signed with the same certificate path as the certificate
	// so we can use the chain from the connection.

View on GitHub (pinned to 03255a9237)

Solutions

1. Fetch a full (unscoped) base CRL from the same CA distribution point that does not set onlySomeReasons.
2. Re-generate or re-issue the CRL with a tool/CA setting that omits the onlySomeReasons ReasonFlags field from the IssuingDistributionPoint extension.
3. Verify with `openssl crl -in crl.pem -noout -text` that Issuing Distribution Point shows no 'Only Some Reasons' line, then reload the CRL.

Example fix

// before: CA issues a CRL with onlySomeReasons set -> error
// after: issue a base CRL covering all reasons
//   openssl ca -gencrl -out base.crl   (no -crl_reason scoping)
// Confirm:
//   openssl crl -in base.crl -noout -text | grep -i 'Only Some'
//   (no output -> accepted by advancedtls)

// Pre-check a CRL's IssuingDistributionPoint before handing it to advancedtls.
import "crypto/x509"
import "encoding/asn1"

func crlHasOnlySomeReasons(c *x509.RevocationList) (bool, error) {
    // oidIssuingDistributionPoint = 2.5.29.28
    oidIDP := asn1.ObjectIdentifier{2, 5, 29, 28}
    for _, ext := range c.Extensions {
        if ext.Id.Equal(oidIDP) {
            // If the extension is present, any non-empty onlySomeReasons is a problem.
            // A full re-parse is library-specific; at minimum flag presence to review.
            return true, nil
        }
    }
    return false, nil
}

func isAcceptableCRL(c *x509.RevocationList) bool {
    return c != nil && !crlHasUnsupportedIDP(c) // returns false for reason-scoped CRLs
}

When it happens

Trigger: A CRL file (PEM or DER) whose IssuingDistributionPoint extension has the onlySomeReasons field populated is supplied to advancedtls CRL processing (e.g. via a CRL provider or when the dialer/server loads a CRL for revocation checking). The moment parseCRLExtensions walks that extension and sees dp.OnlySomeReasons.BitLength != 0, it returns this error.

Common situations: Enterprise CAs or PKI tooling that emit reason-restricted CRLs by policy; a CRL distribution point that serves segmented CRLs (one per reason code); upgrading a CA that now populates onlySomeReasons where it previously did not.

Related errors

• authority key identifier extension missing
• extractCRLIssuer: invalid ASN.1 encoding
• no DN found in certificate issuer
• trailing data after AKID extension
• trailing data after IssuingDistributionPoint extension

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/5a68df2a75469ca9. Report an issue: GitHub.