Error parsing certificate for subject alt names

Error message

Error parsing certificate for subject alt names [{}]: [{}]

What it means

This warning is logged when X.509Certificate.getSubjectAlternativeNames() throws a CertificateParsingException while extracting subject alt names from a client certificate. The method catches the exception, logs the certificate's subject DN and the parse error message, and returns an empty collection instead of propagating the failure. The certificate is still usable elsewhere; only SAN extraction failed.

Solutions

Inspect the offending certificate with 'keytool -printcert -file cert.pem' or 'openssl x509 -text' to see whether the SAN extension is malformed.
Regenerate/reissue the certificate from a standards-compliant CA (e.g. ensure SANs are created with proper GeneralName encoding via keytool -ext or openssl -addext).
Verify the JDK/BouncyCastle provider versions; upgrade to a JCE provider that parses the SAN GeneralName types in question.
If the SANs are genuinely unusable, accept the empty-collection fallback and rely on the certificate's subject DN/RDNs for principal resolution instead.

Example fix

// before
Collection<List<?>> sans = X509ExtractorUtils.getSubjectAltNames(cert);
if (sans.isEmpty()) { throw new IllegalArgumentException("no SANs"); }
// after
Collection<List<?>> sans = X509ExtractorUtils.getSubjectAltNames(cert);
if (sans.isEmpty()) {
    // fall back to subject DN instead of hard-failing
    sans = X509ExtractorUtils.extractPrincipalFromRfc822Name(cert);
}

Defensive patterns

Strategy: fallback

Validate before calling

boolean hasSanExtension(X509Certificate c) {
    return c.getExtensionValue("2.5.29.17") != null;
}

Type guard

Collection<List<?>> safeSans = cert.getSubjectAlternativeNames() == null
        ? java.util.CollectionUtils.emptyCollection()
        : cert.getSubjectAlternativeNames();

Try / catch

try {
    var sans = X509ExtractorUtils.getSubjectAltNames(cert);
    // use sans (may be empty)
} catch (GeneralSecurityException e) {
    LOGGER.warn("SAN extraction failed for [{}]; falling back to subject DN", cert.getSubjectDN(), e);
    // fall back to principal from subject DN
}

Prevention

Issue certificates with standards-compliant SAN encoding from a reputable CA.
Validate client certificates with openssl x509 -text before deploying them.
Keep the JDK/BouncyCastle provider up to date for broad GeneralName support.
Design principal resolution to tolerate empty SANs via subject DN fallback.

When it happens

Trigger: Calling getSubjectAltNames(X509Certificate) on a certificate whose SAN extension is malformed, encoded in an unexpected/unrecognized GeneralName form, or otherwise fails ASN.1 parsing inside getSubjectAlternativeNames().

Common situations: Client certificates issued by unusual/non-compliant CAs or embedded devices with hand-rolled encoders; certificates whose SAN extension uses GeneralName types the JCE parser cannot decode; corrupted or truncated certificates pulled from keystores, smart cards, or PEM conversion.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/158183bbeccde961. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/principal/X509ExtractorUtils.java:115

        }
        return subjectAltNames
                .stream()
                .filter(name -> name.size() == 2 && (Integer) name.getFirst() == SAN_RFC822_EMAIL_TYPE)
                .findFirst()
                .map(objects -> (String) objects.get(1));
    }

    /**
     * Get subject alt names without checked exception.
     * @param certificate x509 certificate
     * @return subject alternative names as collection of two item lists, empty collection if null or error
     */
    public Collection<List<?>> getSubjectAltNames(final X509Certificate certificate) {
        try {
            val subjectAltNames = certificate.getSubjectAlternativeNames();
            return subjectAltNames != null ? subjectAltNames : CollectionUtils.emptyCollection();
        } catch (final CertificateParsingException e) {
            LOGGER.warn("Error parsing certificate for subject alt names [{}]: [{}]", certificate.getSubjectDN(), e.getMessage(), e);
            return CollectionUtils.emptyCollection();
        }
    }
}

View on GitHub (pinned to e7288fc434)