What causes "ERROR_IN_CRL_LAST_UPDATE_FIELD" in oven-sh/bun?

Reissue the CRL from maintained CA software with standard date encodings

oven-sh/bun · error · CertError

ERROR_IN_CRL_LAST_UPDATE_FIELD

ERROR_IN_CRL_LAST_UPDATE_FIELD

Error message

ERROR_IN_CRL_LAST_UPDATE_FIELD

What it means

X509 verify result 15 (X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD): the CRL's lastUpdate (thisUpdate) field is malformed and cannot be parsed. Mapped via get_cert_error_from_no (src/http/lib.rs:1534) to CertError::ERROR_IN_CRL_LAST_UPDATE_FIELD (FetchTasklet.rs message table).

Source

Thrown at src/http/error.rs:151

    #[error("UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY")]
    UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY,
    #[error("CERT_SIGNATURE_FAILURE")]
    CERT_SIGNATURE_FAILURE,
    #[error("CRL_SIGNATURE_FAILURE")]
    CRL_SIGNATURE_FAILURE,
    #[error("CERT_NOT_YET_VALID")]
    CERT_NOT_YET_VALID,
    #[error("CERT_HAS_EXPIRED")]
    CERT_HAS_EXPIRED,
    #[error("CRL_NOT_YET_VALID")]
    CRL_NOT_YET_VALID,
    #[error("CRL_HAS_EXPIRED")]
    CRL_HAS_EXPIRED,
    #[error("ERROR_IN_CERT_NOT_BEFORE_FIELD")]
    ERROR_IN_CERT_NOT_BEFORE_FIELD,
    #[error("ERROR_IN_CERT_NOT_AFTER_FIELD")]
    ERROR_IN_CERT_NOT_AFTER_FIELD,
    #[error("ERROR_IN_CRL_LAST_UPDATE_FIELD")]
    ERROR_IN_CRL_LAST_UPDATE_FIELD,
    #[error("ERROR_IN_CRL_NEXT_UPDATE_FIELD")]
    ERROR_IN_CRL_NEXT_UPDATE_FIELD,
    #[error("OUT_OF_MEM")]
    OUT_OF_MEM,
    #[error("DEPTH_ZERO_SELF_SIGNED_CERT")]
    DEPTH_ZERO_SELF_SIGNED_CERT,
    #[error("SELF_SIGNED_CERT_IN_CHAIN")]
    SELF_SIGNED_CERT_IN_CHAIN,
    #[error("UNABLE_TO_GET_ISSUER_CERT_LOCALLY")]
    UNABLE_TO_GET_ISSUER_CERT_LOCALLY,
    #[error("UNABLE_TO_VERIFY_LEAF_SIGNATURE")]
    UNABLE_TO_VERIFY_LEAF_SIGNATURE,
    #[error("CERT_CHAIN_TOO_LONG")]
    CERT_CHAIN_TOO_LONG,
    #[error("CERT_REVOKED")]
    CERT_REVOKED,
    #[error("INVALID_CA")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Reissue the CRL from maintained CA software with standard date encodings
Inspect: openssl crl -in crl.pem -noout -lastupdate — a parse error confirms corruption
Disable CRL checking for this host until the CA output is fixed
Move the PKI to OCSP so CRL parsing is not on the request path

Defensive patterns

Strategy: try-catch

Type guard

function isCertErrorCode(e: unknown, code = "ERROR_IN_CRL_LAST_UPDATE_FIELD"): e is Error & { code: string } {
  return e instanceof Error && (e as any).code === code;
}

Try / catch

try {
  await fetch(url);
} catch (e) {
  if (isCertErrorCode(e, "ERROR_IN_CRL_LAST_UPDATE_FIELD")) {
    throw new Error("CRL has a malformed lastUpdate field — PKI must reissue the CRL");
  }
  throw e;
}

Prevention

Use maintained CA software to sign CRLs
Parse-check CRLs (openssl crl -noout -lastupdate) in PKI CI
Move to OCSP where CRL quality can't be guaranteed

When it happens

Trigger: TLS handshake with CRL checking where the CRL fetched for a chain cert has an unparseable thisUpdate field.

Common situations: Hand-rolled or ancient CA software emitting non-conformant CRL timestamps; corrupted CRL downloads.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/c7fccfd152233b09. Report an issue: GitHub.