What causes "ERROR_IN_CRL_NEXT_UPDATE_FIELD" in oven-sh/bun?

Regenerate the CRL with a valid nextUpdate from current CA tooling

oven-sh/bun · error · CertError

ERROR_IN_CRL_NEXT_UPDATE_FIELD

ERROR_IN_CRL_NEXT_UPDATE_FIELD

Error message

ERROR_IN_CRL_NEXT_UPDATE_FIELD

What it means

X509 verify result 16 (X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD): the CRL's nextUpdate field is malformed or missing where required, so CRL freshness cannot be determined. Mapped via get_cert_error_from_no (src/http/lib.rs:1535) to CertError::ERROR_IN_CRL_NEXT_UPDATE_FIELD (FetchTasklet.rs message table).

Source

Thrown at src/http/error.rs:153

    #[error("CERT_SIGNATURE_FAILURE")]
    CERT_SIGNATURE_FAILURE,
    #[error("CRL_SIGNATURE_FAILURE")]
    CRL_SIGNATURE_FAILURE,
    #[error("CERT_NOT_YET_VALID")]
    CERT_NOT_YET_VALID,
    #[error("CERT_HAS_EXPIRED")]
    CERT_HAS_EXPIRED,
    #[error("CRL_NOT_YET_VALID")]
    CRL_NOT_YET_VALID,
    #[error("CRL_HAS_EXPIRED")]
    CRL_HAS_EXPIRED,
    #[error("ERROR_IN_CERT_NOT_BEFORE_FIELD")]
    ERROR_IN_CERT_NOT_BEFORE_FIELD,
    #[error("ERROR_IN_CERT_NOT_AFTER_FIELD")]
    ERROR_IN_CERT_NOT_AFTER_FIELD,
    #[error("ERROR_IN_CRL_LAST_UPDATE_FIELD")]
    ERROR_IN_CRL_LAST_UPDATE_FIELD,
    #[error("ERROR_IN_CRL_NEXT_UPDATE_FIELD")]
    ERROR_IN_CRL_NEXT_UPDATE_FIELD,
    #[error("OUT_OF_MEM")]
    OUT_OF_MEM,
    #[error("DEPTH_ZERO_SELF_SIGNED_CERT")]
    DEPTH_ZERO_SELF_SIGNED_CERT,
    #[error("SELF_SIGNED_CERT_IN_CHAIN")]
    SELF_SIGNED_CERT_IN_CHAIN,
    #[error("UNABLE_TO_GET_ISSUER_CERT_LOCALLY")]
    UNABLE_TO_GET_ISSUER_CERT_LOCALLY,
    #[error("UNABLE_TO_VERIFY_LEAF_SIGNATURE")]
    UNABLE_TO_VERIFY_LEAF_SIGNATURE,
    #[error("CERT_CHAIN_TOO_LONG")]
    CERT_CHAIN_TOO_LONG,
    #[error("CERT_REVOKED")]
    CERT_REVOKED,
    #[error("INVALID_CA")]
    INVALID_CA,
    #[error("PATH_LENGTH_EXCEEDED")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Regenerate the CRL with a valid nextUpdate from current CA tooling
Inspect both fields: openssl crl -in crl.pem -noout -lastupdate -nextupdate
Relax client-side strict CRL checking for the host or move to OCSP
Upgrade the CA software if it cannot emit conforming CRLs

Defensive patterns

Strategy: try-catch

Type guard

function isCertErrorCode(e: unknown, code = "ERROR_IN_CRL_NEXT_UPDATE_FIELD"): e is Error & { code: string } {
  return e instanceof Error && (e as any).code === code;
}

Try / catch

try {
  await fetch(url);
} catch (e) {
  if (isCertErrorCode(e, "ERROR_IN_CRL_NEXT_UPDATE_FIELD")) {
    throw new Error("CRL has a malformed nextUpdate field — PKI must reissue the CRL");
  }
  throw e;
}

Prevention

Ensure CRL profiles always include a valid nextUpdate
Validate CRLs on publication with openssl crl -noout -nextupdate
Prefer OCSP for revocation where possible

When it happens

Trigger: TLS handshake with CRL revocation checking where the CRL's nextUpdate is unparseable — CAs omitting the field (not allowed in strict profiles) or emitting garbage.

Common situations: Old Microsoft/legacy CA CRL profiles, custom CRL signers skipping nextUpdate, or bytes corrupted in transit.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/5d16634e5e6b3500. Report an issue: GitHub.