Unable to add CRL to https request

[dreamsparkx]

I am trying to run following code:

const https = require('node:https')
const fs = require('fs')
const crlData = fs.readFileSync('./leaf.crl.pem');
const intermediate = fs.readFileSync('./intermediate.pem')
const root = fs.readFileSync('./root.pem')

const options = {
    host: 'xx.xxx.xxx.xx',
    port: xxxxx,
    "path": "/xx/xxxxx/xxxx/hello",
    method: 'GET',
    ca: [ intermediate, root ],
    rejectUnauthorized: true,
    checkServerIdentity: function () {
        return false;
    },
    crl: crlData,
};
const req = https.request(options, (res) => {
    console.log('statusCode:', res.statusCode);
    console.log('headers:', res.headers);
    res.on('data', (d) => {
        process.stdout.write(d);
    });
});  
req.on('error', (e) => {
    console.error(e);
});
req.end();

But getting following error:

Error: unable to get certificate CRL
    at TLSSocket.onConnectSecure (node:_tls_wrap:1539:34)
    at TLSSocket.emit (node:events:513:28)
    at TLSSocket._finishInit (node:_tls_wrap:953:8)
    at TLSWrap.ssl.onhandshakedone (node:_tls_wrap:734:12) {
  code: 'UNABLE_TO_GET_CRL'
}

Can someone explain the error and help?

[kumarrishav]

I was getting the same error as well.

after adding intermediate and root CA CRL,

i am getting CRL_SIGNATURE_FAILURE. Currently using unsigned CRL. Is there any way to ignore this CRL_SIGNATURE validation?

any alternative to the following in nodejs
https://learn.microsoft.com/en-us/dotnet/api/java.security.cert.x509crl.verify?view=net-android-34.0
https://docs.oracle.com/javase/8/docs/api/java/security/cert/X509CRL.html#verify-java.security.PublicKey-

[ujamX]

Error: unable to get certificate CRL CRL errors occur during state checking when accessing a TLS connection. This error usually means that the CRL fetch failed.

Check if the CRL server status is operating normally. After that, try accessing the CRL URL directly.
If access is not possible properly, the URL may be incorrect or there may be a network problem.

Although not recommended, you can set NODE_TLS_REJECT_UNAUTHORIZED=0 to bypass TLS checking

If you have any additional questions, please let me know.