oven-sh/bun · error · TypeError

UNABLE_TO_GET_CRL_ISSUER

UNABLE_TO_GET_CRL_ISSUER

Error message

UNABLE_TO_GET_CRL_ISSUER

What it means

CertError::UNABLE_TO_GET_CRL_ISSUER maps BoringSSL X509 verify code 33 (X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER) via get_cert_error_from_no() in src/http/lib.rs:1552. CRL-based checking is in play and a CRL was found, but the certificate that issued the CRL cannot be located in the verification context, so revocation status cannot be completed. JS error.code is UNABLE_TO_GET_CRL_ISSUER with message 'unable to get CRL issuer certificate' (FetchTasklet.rs:1481).

Source

Thrown at src/http/error.rs:187

    #[error("INVALID_CA")]
    INVALID_CA,
    #[error("PATH_LENGTH_EXCEEDED")]
    PATH_LENGTH_EXCEEDED,
    #[error("INVALID_PURPOSE")]
    INVALID_PURPOSE,
    #[error("CERT_UNTRUSTED")]
    CERT_UNTRUSTED,
    #[error("CERT_REJECTED")]
    CERT_REJECTED,
    #[error("SUBJECT_ISSUER_MISMATCH")]
    SUBJECT_ISSUER_MISMATCH,
    #[error("AKID_SKID_MISMATCH")]
    AKID_SKID_MISMATCH,
    #[error("AKID_ISSUER_SERIAL_MISMATCH")]
    AKID_ISSUER_SERIAL_MISMATCH,
    #[error("KEYUSAGE_NO_CERTSIGN")]
    KEYUSAGE_NO_CERTSIGN,
    #[error("UNABLE_TO_GET_CRL_ISSUER")]
    UNABLE_TO_GET_CRL_ISSUER,
    #[error("UNHANDLED_CRITICAL_EXTENSION")]
    UNHANDLED_CRITICAL_EXTENSION,
    #[error("KEYUSAGE_NO_CRL_SIGN")]
    KEYUSAGE_NO_CRL_SIGN,
    #[error("UNHANDLED_CRITICAL_CRL_EXTENSION")]
    UNHANDLED_CRITICAL_CRL_EXTENSION,
    #[error("INVALID_NON_CA")]
    INVALID_NON_CA,
    #[error("PROXY_PATH_LENGTH_EXCEEDED")]
    PROXY_PATH_LENGTH_EXCEEDED,
    #[error("KEYUSAGE_NO_DIGITAL_SIGNATURE")]
    KEYUSAGE_NO_DIGITAL_SIGNATURE,
    #[error("PROXY_CERTIFICATES_NOT_ALLOWED")]
    PROXY_CERTIFICATES_NOT_ALLOWED,
    #[error("INVALID_EXTENSION")]
    INVALID_EXTENSION,
    #[error("INVALID_POLICY_EXTENSION")]

View on GitHub (pinned to 8c5296ac45)

Solutions

  1. Identify the CRL signer: openssl crl -in crl.pem -noout -issuer, then obtain that certificate from the CA
  2. Add the CRL issuer certificate to the chain/CA material so validation can link it
  3. If you operate the PKI, drop the indirect-CRL setup and let the CA sign its own CRLs
  4. Fallback for endpoints you control: disable CRL enforcement for that connection path (no CRLs supplied means no CRL-based failure)

Example fix

# before: indirect CRL signer not shipped
openssl crl -in crl.pem -noout -issuer
# issuer: CN=Corp CRL Signer, O=Corp  <- cert missing from bundle
# after: include the CRL signer cert alongside the CA
openssl crl -in crl.pem -CAfile crl-signer.pem -noout  # verify CRL signature OK
cat ca.pem crl-signer.pem > bundle.pem  # distribute bundle.pem
Defensive patterns

Strategy: try-catch

Validate before calling

import { execSync } from "node:child_process";
const crlIssuer = execSync("openssl crl -in crl.pem -noout -issuer").toString();
const haveIt = execSync("openssl verify -CAfile bundle.pem crl.pem 2>&1 || true").toString();
// if the CRL signature cannot be verified against bundle.pem, the CRL issuer cert is missing

Type guard

function isCrlIssuerMissing(e: unknown): e is Error & { code: "UNABLE_TO_GET_CRL_ISSUER" } {
  return e instanceof Error && (e as any).code === "UNABLE_TO_GET_CRL_ISSUER";
}

Try / catch

try { await fetch(url); } catch (e) { if (isCrlIssuerMissing(e)) { logger.warn("CRL issuer cert unavailable for " + url); return fetchWithoutCrlContext(url); } throw e; }

Prevention

When it happens

Trigger: TLS handshake where revocation checking via CRLs is active and the CRL presented/found is signed by an issuer cert that is not in the chain or trust store (e.g., dedicated CRL-signing delegated cert).

Common situations: Private PKI that delegates CRL signing to a separate key ( indirect CRL ), CRL signer cert not distributed alongside the CA bundle, enterprise gateways that inject CRL checking then fail on incomplete issuer sets.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/61b7a8c97340e0fc. Report an issue: GitHub.