What causes "DIFFERENT_CRL_SCOPE" in oven-sh/bun?

Inspect the CRL scope: openssl crl -in crl.pem -noout -text and check the Issuing Distribution Point extension

oven-sh/bun · error · TypeError

DIFFERENT_CRL_SCOPE

DIFFERENT_CRL_SCOPE

Error message

DIFFERENT_CRL_SCOPE

What it means

CertError::DIFFERENT_CRL_SCOPE maps BoringSSL X509_V_ERR_DIFFERENT_CRL_SCOPE (verify code 44). With CRL checking enabled, the CRL located for an issuer does not cover the certificate being checked: its issuingDistributionPoint extension scopes it elsewhere (indirect CRL, delta CRL, or only-CA/only-user attributes mismatch). Message: "Different CRL scope".

Source

Thrown at src/http/error.rs:209

    #[error("KEYUSAGE_NO_CRL_SIGN")]
    KEYUSAGE_NO_CRL_SIGN,
    #[error("UNHANDLED_CRITICAL_CRL_EXTENSION")]
    UNHANDLED_CRITICAL_CRL_EXTENSION,
    #[error("INVALID_NON_CA")]
    INVALID_NON_CA,
    #[error("PROXY_PATH_LENGTH_EXCEEDED")]
    PROXY_PATH_LENGTH_EXCEEDED,
    #[error("KEYUSAGE_NO_DIGITAL_SIGNATURE")]
    KEYUSAGE_NO_DIGITAL_SIGNATURE,
    #[error("PROXY_CERTIFICATES_NOT_ALLOWED")]
    PROXY_CERTIFICATES_NOT_ALLOWED,
    #[error("INVALID_EXTENSION")]
    INVALID_EXTENSION,
    #[error("INVALID_POLICY_EXTENSION")]
    INVALID_POLICY_EXTENSION,
    #[error("NO_EXPLICIT_POLICY")]
    NO_EXPLICIT_POLICY,
    #[error("DIFFERENT_CRL_SCOPE")]
    DIFFERENT_CRL_SCOPE,
    #[error("UNSUPPORTED_EXTENSION_FEATURE")]
    UNSUPPORTED_EXTENSION_FEATURE,
    #[error("UNNESTED_RESOURCE")]
    UNNESTED_RESOURCE,
    #[error("PERMITTED_VIOLATION")]
    PERMITTED_VIOLATION,
    #[error("EXCLUDED_VIOLATION")]
    EXCLUDED_VIOLATION,
    #[error("SUBTREE_MINMAX")]
    SUBTREE_MINMAX,
    #[error("APPLICATION_VERIFICATION")]
    APPLICATION_VERIFICATION,
    #[error("UNSUPPORTED_CONSTRAINT_TYPE")]
    UNSUPPORTED_CONSTRAINT_TYPE,
    #[error("UNSUPPORTED_CONSTRAINT_SYNTAX")]
    UNSUPPORTED_CONSTRAINT_SYNTAX,
    #[error("UNSUPPORTED_NAME_SYNTAX")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Inspect the CRL scope: openssl crl -in crl.pem -noout -text and check the Issuing Distribution Point extension
Regenerate the CRL without restrictive scope flags (no onlyContainsCACerts/onlyContainsUserCerts for a full CRL) or publish the CRL for the correct partition
Fix the CRL Distribution Point URL in the cert to point at the CRL that actually covers it
If revocation is handled by OCSP instead, drop CRL checking on the verifier

Example fix

# before: CRL scoped to CAs only, used against a leaf
openssl ca -gencrl -crlexts crl_ext ...
[crl_ext]
issuingDistributionPoint = critical, onlycontainscacerts, URI:http://crl.example.com/ca.crl

# after: full-scope CRL
[crl_ext]
issuingDistributionPoint = URI:http://crl.example.com/ca.crl

Defensive patterns

Strategy: try-catch

Type guard

export function isDifferentCrlScope(e): e is Error & { code: "DIFFERENT_CRL_SCOPE" } {
  return e instanceof Error && (e as any).code === "DIFFERENT_CRL_SCOPE";
}

Try / catch

try {
  await fetch(url);
} catch (e) {
  if (e?.code === "DIFFERENT_CRL_SCOPE") {
    // CRL fetched for the issuer doesn't cover this cert - fix CRL scope or CDP URL
    openPkiTicket("crl-scope", url);
  } else throw e;
}

Prevention

Publish full-scope CRLs at the URLs named in CRL Distribution Points
After any CRL partitioning change, test with openssl verify -crl_check from a clean host
Prefer OCSP stapling where possible to sidestep CRL scoping entirely

When it happens

Trigger: Verification with X509_V_FLAG_CRL_CHECK(_ALL) where the fetched CRL's idp extension excludes the leaf (e.g. CRL marked onlyContainsCACerts=true used to check a leaf, or a CRL issued by an indirect CRL issuer for a different partition).

Common situations: Enterprise PKIs with partitioned/indirect CRLs; a CDN or hosting layer serving the wrong CRL at the CDP URL; CRL generation templates that accidentally set scope attributes; test environments where the CRL was regenerated for a different CA partition.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/f3191d1a6e7fb209. Report an issue: GitHub.