oven-sh/bun · error · TypeError

UNSUPPORTED_EXTENSION_FEATURE

UNSUPPORTED_EXTENSION_FEATURE

Error message

UNSUPPORTED_EXTENSION_FEATURE

What it means

CertError::UNSUPPORTED_EXTENSION_FEATURE maps BoringSSL X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE (verify code 45). A certificate/CRL extension uses a feature the verifying implementation does not support during path validation (classic cases: delta CRL indicators, certain policy-constraint processing). Message: "Unsupported extension feature".

Source

Thrown at src/http/error.rs:211

    #[error("UNHANDLED_CRITICAL_CRL_EXTENSION")]
    UNHANDLED_CRITICAL_CRL_EXTENSION,
    #[error("INVALID_NON_CA")]
    INVALID_NON_CA,
    #[error("PROXY_PATH_LENGTH_EXCEEDED")]
    PROXY_PATH_LENGTH_EXCEEDED,
    #[error("KEYUSAGE_NO_DIGITAL_SIGNATURE")]
    KEYUSAGE_NO_DIGITAL_SIGNATURE,
    #[error("PROXY_CERTIFICATES_NOT_ALLOWED")]
    PROXY_CERTIFICATES_NOT_ALLOWED,
    #[error("INVALID_EXTENSION")]
    INVALID_EXTENSION,
    #[error("INVALID_POLICY_EXTENSION")]
    INVALID_POLICY_EXTENSION,
    #[error("NO_EXPLICIT_POLICY")]
    NO_EXPLICIT_POLICY,
    #[error("DIFFERENT_CRL_SCOPE")]
    DIFFERENT_CRL_SCOPE,
    #[error("UNSUPPORTED_EXTENSION_FEATURE")]
    UNSUPPORTED_EXTENSION_FEATURE,
    #[error("UNNESTED_RESOURCE")]
    UNNESTED_RESOURCE,
    #[error("PERMITTED_VIOLATION")]
    PERMITTED_VIOLATION,
    #[error("EXCLUDED_VIOLATION")]
    EXCLUDED_VIOLATION,
    #[error("SUBTREE_MINMAX")]
    SUBTREE_MINMAX,
    #[error("APPLICATION_VERIFICATION")]
    APPLICATION_VERIFICATION,
    #[error("UNSUPPORTED_CONSTRAINT_TYPE")]
    UNSUPPORTED_CONSTRAINT_TYPE,
    #[error("UNSUPPORTED_CONSTRAINT_SYNTAX")]
    UNSUPPORTED_CONSTRAINT_SYNTAX,
    #[error("UNSUPPORTED_NAME_SYNTAX")]
    UNSUPPORTED_NAME_SYNTAX,
    #[error("CRL_PATH_VALIDATION_ERROR")]

View on GitHub (pinned to 8c5296ac45)

Solutions

  1. Identify the offending extension: openssl crl -in crl.pem -noout -text (look for Delta CRL Indicator / freshestCRL) or openssl x509 -text
  2. Reissue the CRL/cert without the unsupported feature (publish complete CRLs, drop delta indicators)
  3. Update the CRL distribution setup so verifiers fetch the base CRL, not the delta
  4. If the feature is mandated by your PKI, verify with a stack that supports it and report the incompatibility upstream

Example fix

# before: publishing a delta CRL at the CDP URL
[crl_ext]
issuingDistributionPoint = URI:http://crl.example.com/delta.crl

# after: publish the full CRL at the CDP URL
issuingDistributionPoint = URI:http://crl.example.com/full.crl
Defensive patterns

Strategy: try-catch

Type guard

export function isUnsupportedExtensionFeature(e): e is Error & { code: "UNSUPPORTED_EXTENSION_FEATURE" } {
  return e instanceof Error && (e as any).code === "UNSUPPORTED_EXTENSION_FEATURE";
}

Try / catch

try {
  await fetch(url);
} catch (e) {
  if (e?.code === "UNSUPPORTED_EXTENSION_FEATURE") {
    // an extension feature (e.g. delta CRL) is beyond what the verifier supports
    fallbackToKnownGoodMirror(url);
  } else throw e;
}

Prevention

When it happens

Trigger: CRL checking enabled and the CRL carries a deltaCRL indicator or other feature BoringSSL's verifier refuses to process; cert extensions that encode options the path builder explicitly declines (rather than merely ignores).

Common situations: PKIs that publish delta CRLs and a verifier that follows CDPs into the delta instead of the base CRL; migration from OpenSSL (which tolerates the feature) to a BoringSSL-based client; appliances generating CRLs with unusual extension combinations.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/bc159cf77a66efde. Report an issue: GitHub.