oven-sh/bun · error · TypeError

KEYUSAGE_NO_CRL_SIGN

KEYUSAGE_NO_CRL_SIGN

Error message

KEYUSAGE_NO_CRL_SIGN

What it means

CertError::KEYUSAGE_NO_CRL_SIGN maps BoringSSL X509 verify code 35 (X509_V_ERR_KEYUSAGE_NO_CRL_SIGN) via get_cert_error_from_no() in src/http/lib.rs:1554. During CRL validation, the certificate that signed the CRL has a keyUsage without the cRLSign bit, so it is not authorized to sign CRLs and revocation checking fails. JS error.code is KEYUSAGE_NO_CRL_SIGN with message 'key usage does not include CRL signing' (FetchTasklet.rs:1487).

Source

Thrown at src/http/error.rs:191

    #[error("INVALID_PURPOSE")]
    INVALID_PURPOSE,
    #[error("CERT_UNTRUSTED")]
    CERT_UNTRUSTED,
    #[error("CERT_REJECTED")]
    CERT_REJECTED,
    #[error("SUBJECT_ISSUER_MISMATCH")]
    SUBJECT_ISSUER_MISMATCH,
    #[error("AKID_SKID_MISMATCH")]
    AKID_SKID_MISMATCH,
    #[error("AKID_ISSUER_SERIAL_MISMATCH")]
    AKID_ISSUER_SERIAL_MISMATCH,
    #[error("KEYUSAGE_NO_CERTSIGN")]
    KEYUSAGE_NO_CERTSIGN,
    #[error("UNABLE_TO_GET_CRL_ISSUER")]
    UNABLE_TO_GET_CRL_ISSUER,
    #[error("UNHANDLED_CRITICAL_EXTENSION")]
    UNHANDLED_CRITICAL_EXTENSION,
    #[error("KEYUSAGE_NO_CRL_SIGN")]
    KEYUSAGE_NO_CRL_SIGN,
    #[error("UNHANDLED_CRITICAL_CRL_EXTENSION")]
    UNHANDLED_CRITICAL_CRL_EXTENSION,
    #[error("INVALID_NON_CA")]
    INVALID_NON_CA,
    #[error("PROXY_PATH_LENGTH_EXCEEDED")]
    PROXY_PATH_LENGTH_EXCEEDED,
    #[error("KEYUSAGE_NO_DIGITAL_SIGNATURE")]
    KEYUSAGE_NO_DIGITAL_SIGNATURE,
    #[error("PROXY_CERTIFICATES_NOT_ALLOWED")]
    PROXY_CERTIFICATES_NOT_ALLOWED,
    #[error("INVALID_EXTENSION")]
    INVALID_EXTENSION,
    #[error("INVALID_POLICY_EXTENSION")]
    INVALID_POLICY_EXTENSION,
    #[error("NO_EXPLICIT_POLICY")]
    NO_EXPLICIT_POLICY,
    #[error("DIFFERENT_CRL_SCOPE")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Check the CA cert: openssl x509 -in ca.pem -noout -text | grep -A1 'Key Usage' — needs 'CRL Sign'
2. Reissue the CA/crl-signer with keyUsage=critical,keyCertSign,cRLSign
3. Regenerate and republish CRLs signed by the corrected cert
4. Alternatively stop enforcing CRLs on that path if revocation is handled out-of-band

Example fix

# before
-addext 'keyUsage=critical,keyCertSign'
# after
-addext 'keyUsage=critical,keyCertSign,cRLSign'
# then re-sign the CRL
openssl ca -gencrl -keyfile ca-key.pem -cert ca.pem -out ca.crl.pem

import { execSync } from "node:child_process";
const text = execSync("openssl x509 -in ca.pem -noout -text").toString();
if (/CRL Sign/.test(text) === false) {
  throw new Error("CA keyUsage lacks cRLSign — CRL validation will fail KEYUSAGE_NO_CRL_SIGN");
}

function isNoCrlSign(e: unknown): e is Error & { code: "KEYUSAGE_NO_CRL_SIGN" } {
  return e instanceof Error && (e as any).code === "KEYUSAGE_NO_CRL_SIGN";
}

try { await fetch(url); } catch (e) { if (isNoCrlSign(e)) { alertPkiTeam("CRL signer lacks cRLSign"); return fetchWithoutCrl(url); } throw e; }

When it happens

Trigger: CRL-based revocation checking encounters a CRL whose signer certificate's keyUsage lacks cRLSign (e.g., a CA issued with only keyCertSign, or a delegated signer without cRLSign).

Common situations: Private PKI CA certs generated with keyUsage=keyCertSign only, CA templates copied minus the cRLSign bit, delegated CRL signers misissued after a template change.

Related errors

• KEYUSAGE_NO_CERTSIGN
• UNABLE_TO_GET_CRL_ISSUER
• KEYUSAGE_NO_DIGITAL_SIGNATURE
• InvalidCRL
• UNABLE_TO_VERIFY_LEAF_SIGNATURE

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/cd6bc715a412ee3c. Report an issue: GitHub.