diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index f46ae20..96d5c9d 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -1398,6 +1398,18 @@ Run easyrsa without commands for usage and command help."
 	if [ "$1" ]; then
 		crl_reason="$1"
 		shift
+
+		case "$crl_reason" in
+			unspecified | \
+			keyCompromise |\
+			CACompromise | \
+			affiliationChanged | \
+			superseded | \
+			cessationOfOperation | \
+			certificateHold ) : # ok
+			;;
+			*) die "Illegal reason: $crl_reason"
+		esac
 	else
 		unset -v crl_reason
 	fi