apereo/cas · error · FailedLoginException

Unlimited certificate path length not allowed by…

Error message

Unlimited certificate path length not allowed by configuration.

What it means

X509CredentialsAuthenticationHandler.validate() bounds CA chain depth. For CA certificates (basicConstraints present) whose path length is Integer.MAX_VALUE (no explicit pathLenConstraint) and where maxPathLengthAllowUnspecified=false, the handler rejects the certificate because the chain depth is unbounded.

Solutions

Set cas.authn.x509.max-path-length-allow-unspecified=true to accept CA certs lacking an explicit pathLenConstraint.
Re-issue the CA certificate with an explicit pathLenConstraint extension.
Authenticate with an end-entity client certificate rather than a CA certificate.
Pair with a sensible maxPathLength value to keep depth bounded (see error 324).

Example fix

// before
cas.authn.x509.max-path-length-allow-unspecified=false
// after
cas.authn.x509.max-path-length-allow-unspecified=true
cas.authn.x509.max-path-length=5

Defensive patterns

Strategy: validation

Validate before calling

int pl = cert.getBasicConstraints();
if (pl == Integer.MAX_VALUE && !allowUnspecified) { reject("unbounded CA path"); }

Type guard

boolean boundedPathAllowed(X509Certificate cert, boolean allowUnspecified) {
    int pl = cert.getBasicConstraints();
    return pl < 0 || pl != Integer.MAX_VALUE || allowUnspecified;
}

Try / catch

try {
    handler.authenticate(credential);
} catch (FailedLoginException e) {
    // unlimited path length rejected: set max-path-length-allow-unspecified=true or re-issue CA
}

Prevention

Know whether your root CAs carry an explicit pathLenConstraint.
Set max-path-length-allow-unspecified deliberately, not accidentally.
Use end-entity certs for client authentication.
Audit CA certs with openssl x509 -text | grep pathlen.

When it happens

Trigger: A CA certificate with basicConstraints pathLength == Integer.MAX_VALUE is presented and cas.authn.x509.max-path-length-allow-unspecified=false.

Common situations: Root CAs without a pathLenConstraint are trusted issuers while strict path validation is configured; hardening config enabled maxPathLengthAllowUnspecified=false without realizing the root CA omits the constraint.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/bfa04b4d3c734772. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/handler/support/X509CredentialsAuthenticationHandler.java:249

        this.revocationChecker.check(cert);

        val pathLength = cert.getBasicConstraints();
        if (pathLength < 0) {
            if (!isCertificateAllowed(cert)) {
                val msg = "Certificate subject does not match pattern " + this.regExSubjectDnPattern.pattern();
                LOGGER.error(msg);
                throw new FailedLoginException(msg);
            }
            if (this.checkKeyUsage && !isValidKeyUsage(cert)) {
                val msg = "Certificate keyUsage constraint forbids SSL client authentication.";
                LOGGER.error(msg);
                throw new FailedLoginException(msg);
            }
        } else {
            if (pathLength == Integer.MAX_VALUE && !this.maxPathLengthAllowUnspecified) {
                val msg = "Unlimited certificate path length not allowed by configuration.";
                LOGGER.error(msg);
                throw new FailedLoginException(msg);
            }
            if (pathLength > this.maxPathLength && pathLength < Integer.MAX_VALUE) {
                val msg = String.format("Certificate path length %s exceeds maximum value %s.", pathLength, this.maxPathLength);
                LOGGER.error(msg);
                throw new FailedLoginException(msg);
            }
        }
    }

    /**
     * Checks if is valid key usage. <p>
     * KeyUsage ::= BIT STRING { digitalSignature (0), nonRepudiation (1),
     * keyEncipherment (2), dataEncipherment (3), keyAgreement (4),
     * keyCertSign (5), cRLSign (6), encipherOnly (7), decipherOnly (8) }
     *
     * @param certificate the certificate
     * @return true, if  valid key usage
     */

View on GitHub (pinned to e7288fc434)