What causes "trailing data after AKID extension" in grpc/grpc-go?

Re-fetch the CRL from the authoritative distribution point to rule out transfer corruption.

trailing data after AKID extension

Error message

trailing data after AKID extension

What it means

Returned by parseCRLExtensions (security/advancedtls/crl.go:332) when ASN.1 unmarshalling the Authority Key Identifier extension leaves trailing bytes. Per DER/BER rules a well-formed extension must consume exactly its encoded length, so leftover bytes indicate a corrupt or non-conformant AKID extension. The check is at lines 327-334.

Source

Thrown at security/advancedtls/crl.go:332

// parseCRLExtensions parses the extensions for a CRL
// and checks that they're supported by the parser.
func parseCRLExtensions(c *x509.RevocationList) (*CRL, error) {
	if c == nil {
		return nil, errors.New("c is nil, expected any value")
	}
	certList := &CRL{certList: c}

	for _, ext := range c.Extensions {
		switch {
		case oidDeltaCRLIndicator.Equal(ext.Id):
			return nil, fmt.Errorf("delta CRLs unsupported")

		case oidAuthorityKeyIdentifier.Equal(ext.Id):
			var a authKeyID
			if rest, err := asn1.Unmarshal(ext.Value, &a); err != nil {
				return nil, fmt.Errorf("asn1.Unmarshal failed: %v", err)
			} else if len(rest) != 0 {
				return nil, errors.New("trailing data after AKID extension")
			}
			certList.authorityKeyID = a.ID

		case oidIssuingDistributionPoint.Equal(ext.Id):
			var dp issuingDistributionPoint
			if rest, err := asn1.Unmarshal(ext.Value, &dp); err != nil {
				return nil, fmt.Errorf("asn1.Unmarshal failed: %v", err)
			} else if len(rest) != 0 {
				return nil, errors.New("trailing data after IssuingDistributionPoint extension")
			}

			if dp.OnlyContainsUserCerts || dp.OnlyContainsCACerts || dp.OnlyContainsAttributeCerts {
				return nil, errors.New("CRL only contains some certificate types")
			}
			if dp.IndirectCRL {
				return nil, errors.New("indirect CRLs unsupported")
			}
			if dp.OnlySomeReasons.BitLength != 0 {

View on GitHub (pinned to 03255a9237)

Solutions

Re-fetch the CRL from the authoritative distribution point to rule out transfer corruption.
If you control the CA, regenerate the CRL with a standards-compliant AKID extension (single DER SEQUENCE, no trailing bytes).
Validate the CRL with openssl (openssl crl -inform DER -text) to confirm the extension parses.
If the CRL is genuinely malformed, exclude it from verification or obtain a corrected one.

Example fix

# before: corrupt CRL at /etc/crls/ca.crl
openssl crl -inform DER -in /etc/crls/ca.crl -text -noout # parse error / trailing data

# after: re-fetch a clean CRL
curl -sfo /etc/crls/ca.crl https://ca.example.com/ca.crl
openssl crl -inform DER -in /etc/crls/ca.crl -text -noout # OK

Defensive patterns

Strategy: validation

Validate before calling

// validate the AKID extension decodes with no trailing bytes before use
var a authKeyID
rest, err := asn1.Unmarshal(akidExt.Value, &a)
if err != nil || len(rest) != 0 {
    return fmt.Errorf("CRL has malformed AKID extension")
}

Try / catch

_, err := crl.Verify(cert, opts)
if err != nil && strings.Contains(err.Error(), "trailing data after AKID") {
    // re-fetch CRL from authoritative source, then retry
}

Prevention

Fetch CRLs from their authoritative distribution point.
Sanity-check CRL files with openssl crl before configuring them.
Detect and reject corrupted CRLs at fetch time.

When it happens

Trigger: A CRL whose AKID extension value is malformed, truncated, or contains extra trailing data beyond the single SEQUENCE; a hand-crafted or partially corrupted CRL file.

Common situations: A buggy CA emitting non-canonical AKID encoding; CRL tampering; a download/copy that truncated or concatenated bytes; an ASN.1 library producing non-minimal encoding.

Related errors

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/8e3933183fbf8313. Report an issue: GitHub.