apereo/cas · error · CertificateException

None of the TrustManagers trust this server certificate…

Error message

None of the TrustManagers trust this server certificate chain

What it means

CompositeX509TrustManager delegates checkServerTrusted to each configured trust manager; none trusted the remote server's certificate chain, so CertificateException is thrown. The input at fault is the server's X509 chain — typically an unknown/self-signed CA, expired cert, or missing intermediates.

Solutions

1. Import the server's CA certificate into a configured trust store
2. Ensure the server sends the full intermediate chain
3. Enable debug logging to inspect per-manager validation failures
4. Check for expired/renamed server certificates

When it happens

Trigger: Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/ssl/CompositeX509TrustManager.java:60 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/35559b322a1dbfdd. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/ssl/CompositeX509TrustManager.java:60

        }
    }

    @Override
    public void checkServerTrusted(final X509Certificate[] chain, final String authType) throws CertificateException {
        val trusted = trustManagers.stream().anyMatch(trustManager -> {
            try {
                trustManager.checkServerTrusted(chain, authType);
                return true;
            } catch (final CertificateException e) {
                if (LOGGER.isDebugEnabled()) {
                    val certs = Arrays.stream(chain).map(Certificate::toString).collect(Collectors.toSet());
                    LOGGER.debug("Unable to trust the server certificates [{}] for auth type [{}]: [{}]", certs, authType, e);
                }
                return false;
            }
        });
        if (!trusted) {
            throw new CertificateException("None of the TrustManagers trust this server certificate chain");
        }
    }

    @Override
    public X509Certificate[] getAcceptedIssuers() {
        val certificates = new ArrayList<X509Certificate>(trustManagers.size());
        this.trustManagers.forEach(trustManager ->
            certificates.addAll(CollectionUtils.wrapList(trustManager.getAcceptedIssuers())));
        return certificates.toArray(X509Certificate[]::new);
    }

}

View on GitHub (pinned to e7288fc434)