hyperledger/fabric · error

could not parse RevocationList

Error message

could not parse RevocationList

What it means

setupCRLs wraps an x509.ParseCRL failure: one of the entries in conf.RevocationList is not a parseable X.509 certificate revocation list. The underlying parse error identifies the exact DER problem (bad syntax, unsupported version, etc.).

Source

Thrown at msp/mspimplsetup.go:224

		{1, 2, 840, 10045, 4, 3, 2}, // oidSignatureECDSAWithSHA256
		{1, 2, 840, 10045, 4, 3, 3}, // oidSignatureECDSAWithSHA384
		{1, 2, 840, 10045, 4, 3, 4}, // oidSignatureECDSAWithSHA512
	}
	for _, id := range ecdsaSignaureAlgorithms {
		if id.Equal(algid) {
			return true
		}
	}
	return false
}

func (msp *bccspmsp) setupCRLs(conf *m.FabricMSPConfig) error {
	// setup the CRL (if present)
	msp.CRL = make([]*pkix.CertificateList, len(conf.RevocationList))
	for i, crlbytes := range conf.RevocationList {
		crl, err := x509.ParseCRL(crlbytes)
		if err != nil {
			return errors.Wrap(err, "could not parse RevocationList")
		}

		// Massage the ECDSA signature values
		if isECDSASignatureAlgorithm(crl.SignatureAlgorithm.Algorithm) {
			r, s, err := utils.UnmarshalECDSASignature(crl.SignatureValue.RightAlign())
			if err != nil {
				return err
			}
			sig, err := utils.MarshalECDSASignature(r, s)
			if err != nil {
				return err
			}
			crl.SignatureValue = asn1.BitString{Bytes: sig, BitLength: 8 * len(sig)}
		}

		// TODO: pre-verify the signature on the CRL and create a map
		//       of CA certs to respective CRLs so that later upon
		//       validation we can already look up the CRL given the

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Regenerate/re-export the CRL from the CA (openssl ca -gencrl) and verify with openssl crl -in crl.pem -noout -text
2. Ensure the loader converts PEM CRLs to DER before adding to RevocationList
3. Remove or replace the malformed file in the MSP crls/ directory
4. Verify the CRL matches the CA that issued it and is complete (not truncated)

Example fix

// before: crl file is actually a certificate
// after: place a real CRL in msp/crls/
//   openssl ca -gencrl -out crl.pem && openssl crl -in crl.pem -outform DER -out crl.der
null

for i, crl := range conf.RevocationList {
    if _, err := x509.ParseCRL(crl); err != nil {
        return fmt.Errorf("RevocationList[%d] is not a valid DER CRL: %w", i, err)
    }
}

func isDerCRL(b []byte) bool {
    _, err := x509.ParseCRL(b)
    return err == nil
}

When it happens

Trigger: Thrown at msp/mspimplsetup.go:224 when the library encounters an invalid state.

Common situations: crls/ directory containing a certificate instead of a CRL; CRL exported in PEM but loaded without PEM-to-DER conversion; truncated file transfer; stale or corrupted CRL files after CA rotation.

Related errors

• public keys do not match
• failed to PEM decode identity bytes: %s
• failed parsing certificate %s
• failed unmarshaling ECDSA signature on identity: %s
• expected two space separated tokens, but got %d

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/3df7424161d401b9. Report an issue: GitHub.