oven-sh/bun · error · TypeError

CRL_PATH_VALIDATION_ERROR

CRL_PATH_VALIDATION_ERROR

Error message

CRL_PATH_VALIDATION_ERROR

What it means

CertError::CRL_PATH_VALIDATION_ERROR maps BoringSSL X509_V_ERR_CRL_PATH_VALIDATION_ERROR (verify code 54). With CRL checking enabled, the certificate chain of the CRL issuer itself failed validation - the CRL's signing path is untrusted, expired, or violates constraints. Message: "CRL path validation error".

Source

Thrown at src/http/error.rs:229

    #[error("UNSUPPORTED_EXTENSION_FEATURE")]
    UNSUPPORTED_EXTENSION_FEATURE,
    #[error("UNNESTED_RESOURCE")]
    UNNESTED_RESOURCE,
    #[error("PERMITTED_VIOLATION")]
    PERMITTED_VIOLATION,
    #[error("EXCLUDED_VIOLATION")]
    EXCLUDED_VIOLATION,
    #[error("SUBTREE_MINMAX")]
    SUBTREE_MINMAX,
    #[error("APPLICATION_VERIFICATION")]
    APPLICATION_VERIFICATION,
    #[error("UNSUPPORTED_CONSTRAINT_TYPE")]
    UNSUPPORTED_CONSTRAINT_TYPE,
    #[error("UNSUPPORTED_CONSTRAINT_SYNTAX")]
    UNSUPPORTED_CONSTRAINT_SYNTAX,
    #[error("UNSUPPORTED_NAME_SYNTAX")]
    UNSUPPORTED_NAME_SYNTAX,
    #[error("CRL_PATH_VALIDATION_ERROR")]
    CRL_PATH_VALIDATION_ERROR,
    #[error("SUITE_B_INVALID_VERSION")]
    SUITE_B_INVALID_VERSION,
    #[error("SUITE_B_INVALID_ALGORITHM")]
    SUITE_B_INVALID_ALGORITHM,
    #[error("SUITE_B_INVALID_CURVE")]
    SUITE_B_INVALID_CURVE,
    #[error("SUITE_B_INVALID_SIGNATURE_ALGORITHM")]
    SUITE_B_INVALID_SIGNATURE_ALGORITHM,
    #[error("SUITE_B_LOS_NOT_ALLOWED")]
    SUITE_B_LOS_NOT_ALLOWED,
    #[error("SUITE_B_CANNOT_SIGN_P_384_WITH_P_256")]
    SUITE_B_CANNOT_SIGN_P_384_WITH_P_256,
    #[error("HOSTNAME_MISMATCH")]
    HOSTNAME_MISMATCH,
    #[error("EMAIL_MISMATCH")]
    EMAIL_MISMATCH,
    #[error("IP_ADDRESS_MISMATCH")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Validate the CRL chain directly: openssl crl -in crl.pem -noout -issuer and openssl verify -crl_check -CAfile ca.pem leaf.pem
2. Renew/reissue the CRL signer certificate and republish the CRL
3. Ensure the verifier's trust store contains the CRL issuer's chain
4. If revocation is via OCSP only, disable CRL fetching on the verifier to avoid the dead path

Example fix

# before: expired CRL signer silently breaks every handshake
openssl ca -gencrl -out stale.crl   # signer cert already expired

# after: reissue signer, then regenerate + republish CRL
openssl x509 -req -in crl-signer.csr -CA ca.pem -days 365 -extfile crl_signer.ext
openssl ca -gencrl -out fresh.crl

// Pre-check the CRL path is verifiable whenever CRL checking is enabled
import { execFileSync } from "node:child_process";
export function crlPathVerifies(certPem, crlPem, caPem) {
  execFileSync("openssl", ["verify", "-crl_check", "-CRLfile", crlPem, "-CAfile", caPem, certPem], { stdio: "pipe" });
  return true; // throws with the CRL-path failure otherwise
}

export function isCrlPathValidationError(e): e is Error & { code: "CRL_PATH_VALIDATION_ERROR" } {
  return e instanceof Error && (e as any).code === "CRL_PATH_VALIDATION_ERROR";
}

try {
  await fetch(url);
} catch (e) {
  if (e?.code === "CRL_PATH_VALIDATION_ERROR") {
    // the CRL issuer's own chain failed - renew CRL signer certs / fix the store
    pagePkiOnCall("crl-path", url);
  } else throw e;
}

When it happens

Trigger: X509_V_FLAG_CRL_CHECK(_ALL) verification where the CRL presented/fetched cannot be chained to the trust store: CRL signer cert expired, missing from the store, or its own chain violates basicConstraints/keyUsage.

Common situations: CRL signer certificates that expire quietly (common - they are short-lived); containers/hosts missing the CA bundle that contains the indirect CRL issuer; PKIs rotating CRL signing keys without republishing signer certs.

Related errors

• DIFFERENT_CRL_SCOPE
• UNSUPPORTED_EXTENSION_FEATURE
• NO_EXPLICIT_POLICY
• PERMITTED_VIOLATION
• EXCLUDED_VIOLATION

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/f3bd6844d8ff802d. Report an issue: GitHub.