What causes "CRL_HAS_EXPIRED" in oven-sh/bun?

Have the CA operations team regenerate and republish the CRL (fix the cron/job that signs CRLs)

oven-sh/bun · error · CertError

CRL_HAS_EXPIRED

CRL_HAS_EXPIRED

Error message

CRL_HAS_EXPIRED

What it means

X509 verify result 12 (X509_V_ERR_CRL_HAS_EXPIRED): the CRL is past its nextUpdate, so revocation information is stale and cannot be trusted for a definitive answer. Mapped via get_cert_error_from_no (src/http/lib.rs:1531) to CertError::CRL_HAS_EXPIRED, message "CRL has expired" (FetchTasklet.rs:1406).

Source

Thrown at src/http/error.rs:145

    #[error("UNABLE_TO_GET_CRL")]
    UNABLE_TO_GET_CRL,
    #[error("UNABLE_TO_DECRYPT_CERT_SIGNATURE")]
    UNABLE_TO_DECRYPT_CERT_SIGNATURE,
    #[error("UNABLE_TO_DECRYPT_CRL_SIGNATURE")]
    UNABLE_TO_DECRYPT_CRL_SIGNATURE,
    #[error("UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY")]
    UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY,
    #[error("CERT_SIGNATURE_FAILURE")]
    CERT_SIGNATURE_FAILURE,
    #[error("CRL_SIGNATURE_FAILURE")]
    CRL_SIGNATURE_FAILURE,
    #[error("CERT_NOT_YET_VALID")]
    CERT_NOT_YET_VALID,
    #[error("CERT_HAS_EXPIRED")]
    CERT_HAS_EXPIRED,
    #[error("CRL_NOT_YET_VALID")]
    CRL_NOT_YET_VALID,
    #[error("CRL_HAS_EXPIRED")]
    CRL_HAS_EXPIRED,
    #[error("ERROR_IN_CERT_NOT_BEFORE_FIELD")]
    ERROR_IN_CERT_NOT_BEFORE_FIELD,
    #[error("ERROR_IN_CERT_NOT_AFTER_FIELD")]
    ERROR_IN_CERT_NOT_AFTER_FIELD,
    #[error("ERROR_IN_CRL_LAST_UPDATE_FIELD")]
    ERROR_IN_CRL_LAST_UPDATE_FIELD,
    #[error("ERROR_IN_CRL_NEXT_UPDATE_FIELD")]
    ERROR_IN_CRL_NEXT_UPDATE_FIELD,
    #[error("OUT_OF_MEM")]
    OUT_OF_MEM,
    #[error("DEPTH_ZERO_SELF_SIGNED_CERT")]
    DEPTH_ZERO_SELF_SIGNED_CERT,
    #[error("SELF_SIGNED_CERT_IN_CHAIN")]
    SELF_SIGNED_CERT_IN_CHAIN,
    #[error("UNABLE_TO_GET_ISSUER_CERT_LOCALLY")]
    UNABLE_TO_GET_ISSUER_CERT_LOCALLY,
    #[error("UNABLE_TO_VERIFY_LEAF_SIGNATURE")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Have the CA operations team regenerate and republish the CRL (fix the cron/job that signs CRLs)
Until then, drop the hard CRL requirement client-side or switch the host to OCSP
Extend nextUpdate periods on the CA's CRL profile if publication cadence is slow
Migrate certs off the lapsed PKI if it is no longer maintained

Defensive patterns

Strategy: try-catch

Type guard

function isCertErrorCode(e: unknown, code = "CRL_HAS_EXPIRED"): e is Error & { code: string } {
  return e instanceof Error && (e as any).code === code;
}

Try / catch

try {
  await fetch(url);
} catch (e) {
  if (isCertErrorCode(e, "CRL_HAS_EXPIRED")) {
    throw new Error("Revocation data stale (CRL expired) — PKI ops must republish");
  }
  throw e;
}

Prevention

Automate CRL republication with nextUpdate well beyond the signing cadence
Alert on CRL nextUpdate approaching on the distribution servers
Don't hard-require CRLs client-side unless the PKI is demonstrably maintained

When it happens

Trigger: TLS handshake with CRL checking active where the published CRL's nextUpdate has passed and the CA has not issued a newer one.

Common situations: Internal CAs whose automated CRL generation job died, long-lived appliances publishing CRLs with short validity, decommissioned PKIs whose CRLs lapsed while certs are still in use.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/9627a77dec25bf7b. Report an issue: GitHub.