oven-sh/bun · critical

InvalidCRL

Error message

InvalidCRL

What it means

An inline certificate revocation list (CRL) supplied in the TLS options failed to parse (uws invalid_crl mapped at src/http/HTTPContext.rs:521; fatal message 'the provided CRL is invalid' at src/http/HTTPThread.rs:372-374). BoringSSL accepted the CA material but rejected the CRL blob, so the SSL context cannot be created and the process crashes.

Source

Thrown at src/http/InitError.rs:11

#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error, strum::IntoStaticStr)]
pub enum InitError {
    #[error("FailedToOpenSocket")]
    FailedToOpenSocket,
    #[error("LoadCAFile")]
    LoadCAFile,
    #[error("InvalidCAFile")]
    InvalidCAFile,
    #[error("InvalidCA")]
    InvalidCA,
    #[error("InvalidCRL")]
    InvalidCRL,
}

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Validate the CRL: `openssl crl -in crl.pem -noout -text` (add `-inform der` if it is DER — then convert: `openssl crl -inform der -in crl.der -out crl.pem`).
2. Re-download a fresh CRL from the distribution point — a truncated transfer is the most common corruption.
3. Confirm the CRL is issued by the same CA you configured (issuer mismatch also fails parsing-based setup).
4. If you do not actually need revocation checking, drop the CRL option entirely.

Example fix

# before
# tls.crl = binary DER downloaded from CDP
curl -s http://pki.corp/crl.der -o crl.der   # used directly -> InvalidCRL
# after
openssl crl -inform der -in crl.der -out crl.pem
openssl crl -in crl.pem -noout   # sanity check
# point config at crl.pem

import { execSync } from 'node:child_process';
execSync('openssl crl -in crl.pem -noout', { stdio: 'pipe' }); // throws on invalid CRL
// then configure tls with the verified file

When it happens

Trigger: Configuring a CRL for fetch/Bun.install TLS verification where the CRL bytes are DER instead of PEM, stale/corrupted, or truncated — mirrors the CA configuration path in HTTPThreadInitOpts (src/http/HTTPContext.rs:538-558).

Common situations: Enterprise PKI setups piping CRLs from an internal distribution point into config; CRL files refreshed by cron jobs that half-failed; PEM/DER format mismatch between what the PKI team publishes and what the client expects.

Related errors

• LoadCAFile
• InvalidCAFile
• UNABLE_TO_GET_CRL_ISSUER
• KEYUSAGE_NO_CRL_SIGN
• UNHANDLED_CRITICAL_CRL_EXTENSION

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/875d2a2e60dd0861. Report an issue: GitHub.