apereo/cas · error · CertificateException

None of the TrustManagers can trust this client certificate…

Error message

None of the TrustManagers can trust this client certificate chain

What it means

CompositeX509TrustManager delegates checkClientTrusted to each configured trust manager; none accepted the presented client certificate chain, so CertificateException is thrown. The input at fault is the client's X509 certificate chain (and auth type), which is not anchored in any of the configured trust stores.

Solutions

1. Import the client certificate or its issuing CA into one of the configured trust stores
2. Check the client is presenting the full chain, not just the leaf
3. Enable debug logging to see per-trust-manager rejection reasons
4. Verify the authType/cipher suite negotiation matches the trust manager expectations

When it happens

Trigger: Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/ssl/CompositeX509TrustManager.java:41 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/643e19772d0e8a61. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/ssl/CompositeX509TrustManager.java:41

    private final List<X509TrustManager> trustManagers;

    @Override
    public void checkClientTrusted(final X509Certificate[] chain, final String authType) throws CertificateException {
        val trusted = this.trustManagers.stream().anyMatch(trustManager -> {
            try {
                trustManager.checkClientTrusted(chain, authType);
                return true;
            } catch (final CertificateException e) {
                if (LOGGER.isDebugEnabled()) {
                    val certs = Arrays.stream(chain).map(Certificate::toString).collect(Collectors.toSet());
                    LOGGER.debug("Unable to trust the client certificates [{}] for auth type [{}]: [{}]", certs, authType, e);
                }
                return false;
            }
        });

        if (!trusted) {
            throw new CertificateException("None of the TrustManagers can trust this client certificate chain");
        }
    }

    @Override
    public void checkServerTrusted(final X509Certificate[] chain, final String authType) throws CertificateException {
        val trusted = trustManagers.stream().anyMatch(trustManager -> {
            try {
                trustManager.checkServerTrusted(chain, authType);
                return true;
            } catch (final CertificateException e) {
                if (LOGGER.isDebugEnabled()) {
                    val certs = Arrays.stream(chain).map(Certificate::toString).collect(Collectors.toSet());
                    LOGGER.debug("Unable to trust the server certificates [{}] for auth type [{}]: [{}]", certs, authType, e);
                }
                return false;
            }
        });
        if (!trusted) {

View on GitHub (pinned to e7288fc434)