What causes "UNABLE_TO_DECRYPT_CRL_SIGNATURE" in oven-sh/bun?

Re-publish the current CRL signed by the active CA at the cRLDistributionPoint URL

oven-sh/bun · error · CertError

UNABLE_TO_DECRYPT_CRL_SIGNATURE

Error message

UNABLE_TO_DECRYPT_CRL_SIGNATURE

What it means

X509 verify result 5 (X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE): the CRL's signature could not be decrypted with the issuing CA's public key, so the CRL cannot be trusted. Mapped via get_cert_error_from_no (src/http/lib.rs:1524) to CertError::UNABLE_TO_DECRYPT_CRL_SIGNATURE, message "unable to decrypt CRL's signature" (FetchTasklet.rs:1385).

Source

Thrown at src/http/error.rs:131

    Brotli(bun_brotli::Error),
    #[error(transparent)]
    Zstd(bun_zstd::ZstdError),
    #[error(transparent)]
    Picohttp(bun_picohttp::ParseResponseError),
}

#[allow(non_camel_case_types)]
#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error, strum::IntoStaticStr)]
pub enum CertError {
    #[error("OK")]
    OK,
    #[error("UNABLE_TO_GET_ISSUER_CERT")]
    UNABLE_TO_GET_ISSUER_CERT,
    #[error("UNABLE_TO_GET_CRL")]
    UNABLE_TO_GET_CRL,
    #[error("UNABLE_TO_DECRYPT_CERT_SIGNATURE")]
    UNABLE_TO_DECRYPT_CERT_SIGNATURE,
    #[error("UNABLE_TO_DECRYPT_CRL_SIGNATURE")]
    UNABLE_TO_DECRYPT_CRL_SIGNATURE,
    #[error("UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY")]
    UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY,
    #[error("CERT_SIGNATURE_FAILURE")]
    CERT_SIGNATURE_FAILURE,
    #[error("CRL_SIGNATURE_FAILURE")]
    CRL_SIGNATURE_FAILURE,
    #[error("CERT_NOT_YET_VALID")]
    CERT_NOT_YET_VALID,
    #[error("CERT_HAS_EXPIRED")]
    CERT_HAS_EXPIRED,
    #[error("CRL_NOT_YET_VALID")]
    CRL_NOT_YET_VALID,
    #[error("CRL_HAS_EXPIRED")]
    CRL_HAS_EXPIRED,
    #[error("ERROR_IN_CERT_NOT_BEFORE_FIELD")]
    ERROR_IN_CERT_NOT_BEFORE_FIELD,
    #[error("ERROR_IN_CERT_NOT_AFTER_FIELD")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Re-publish the current CRL signed by the active CA at the cRLDistributionPoint URL
Confirm the CRL is intact: openssl crl -in crl.pem -noout -text and verify its signature against the CA cert
Disable CRL-based checking on the client for this host and rely on OCSP
Rotate the environment to a PKI that does not depend on CRLs

Defensive patterns

Strategy: try-catch

Type guard

function isCertErrorCode(e: unknown, code = "UNABLE_TO_DECRYPT_CRL_SIGNATURE"): e is Error & { code: string } {
  return e instanceof Error && (e as any).code === code;
}

Try / catch

try {
  await fetch(url);
} catch (e) {
  if (isCertErrorCode(e, "UNABLE_TO_DECRYPT_CRL_SIGNATURE")) {
    // PKI-side CRL problem; disable CRL requirement for this host or escalate
    throw new Error("Peer CRL failed signature validation");
  }
  throw e;
}

Prevention

Re-sign and republish CRLs immediately after any CA key rotation
Automate CRL generation so stale/mismatched CRLs are never served
Validate CRLs in PKI CI: openssl crl -CAfile ca.pem -noout -verify

When it happens

Trigger: A TLS handshake with CRL checking active where the fetched CRL was not signed by the CA that issued the certificate (stale or mismatched CRL), or the CRL bytes are corrupt.

Common situations: Internal PKIs after CA rotation where old CRLs remain published, manually assembled CRL bundles with the wrong file, or CRL distribution points serving truncated downloads.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/63904f32574b6261. Report an issue: GitHub.