Currently the cert-release-hold command will not show any error message if the certificate to be released is not already on-hold.

This is because the RevocationProcessor calls IRequestQueue.processRequest() to process the revocation/unrevocation request. In general the processRequest() will not throw an exception on error, but it will store the error message in the request object. The caller is responsible to check the request status/error as follows:

requestQueue.processRequest(request);
status = request.getRequestStatus();

if (status == RequestStatus.COMPLETE) {
    result = request.getExtDataInInteger(IRequest.RESULT);
    if (result.equals(IRequest.RES_SUCCESS)) {
        // request completed successfully
    } else {
        error = request.getExtDataInString(IRequest.ERROR);
        // request completed with error
    }
}

Ideally the RevocationProcessor should throw an exception when there's an error, but it's not clear yet whether this is the appropriate place because it may affect DoRevoke and DoUnrevoke servlets.

One alternative is to check the request status/error in the CertResourceService and throw an exception there. Another alternative is to let the client (e.g. CertReleaseHoldCLI) check the request status/error, this way the CLI can still get the full request info.