apereo/cas · error · IllegalArgumentException

Error reading certificate

Error message

Error reading certificate 

What it means

readCertificate(resource) could not open the given resource's stream or parse its contents as an X.509 certificate (CertUtil.readCertificate threw), so the cause is rethrown as IllegalArgumentException. The input at fault is the certificate resource — wrong path, unreadable stream, or non-PEM/DER content.

Solutions

1. Verify the certificate resource path/URL is correct and readable
2. Confirm the file contains a valid PEM or DER X.509 certificate
3. Inspect the wrapped cause for the precise parse or I/O failure

When it happens

Trigger: Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/crypto/CertUtils.java:62 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/660ebd5edced0e6f. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/crypto/CertUtils.java:62

     * @param crl       CRL to examine.
     * @param reference Reference date for comparison.
     * @return True if reference date is after CRL next update, false otherwise.
     */
    public static boolean isExpired(final X509CRL crl, final ZonedDateTime reference) {
        return reference.isAfter(DateTimeUtils.zonedDateTimeOf(crl.getNextUpdate()));
    }

    /**
     * Read certificate.
     *
     * @param resource the resource to read the cert from
     * @return the x 509 certificate
     */
    public static X509Certificate readCertificate(final InputStreamSource resource) {
        try (val in = resource.getInputStream()) {
            return CertUtil.readCertificate(in);
        } catch (final Exception e) {
            throw new IllegalArgumentException("Error reading certificate " + resource, e);
        }
    }

    /**
     * Read certificate x 509 certificate.
     *
     * @param resource the resource
     * @return the x 509 certificate
     */
    public static X509Certificate readCertificate(final InputStream resource) {
        return readCertificate(new InputStreamResource(resource));
    }

    /**
     * Creates a unique and human-readable representation of the given certificate.
     *
     * @param cert Certificate.
     * @return String representation of a certificate that includes the subject and serial number.

View on GitHub (pinned to e7288fc434)