{"record":{"id":"0829093dc1c4809a","repo":"apereo/cas","slug":"could-not-decode-provided-entity-certificate-file","errorCode":null,"errorMessage":"Could not decode provided Entity Certificate file ","messagePattern":"Could not decode provided Entity Certificate file ","errorType":"exception","errorClass":"BeanCreationException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-saml-core-api/src/main/java/org/apereo/cas/support/saml/util/credential/BasicX509CredentialFactoryBean.java","lineNumber":129,"sourceCode":"\n    @Override\n    public Class<?> getObjectType() {\n        return BasicX509Credential.class;\n    }\n\n    private X509Certificate getEntityCertificate() {\n        if (null == entityResource) {\n            return null;\n        }\n        try {\n            val certs = X509Support.decodeCertificates(entityResource.getInputStream());\n            if (certs.size() > 1) {\n                throw new BeanCreationException(\"Configuration element indicated an entityCertificate,\"\n                    + \" but multiple certificates were decoded\");\n            }\n            return certs.iterator().next();\n        } catch (final Exception e) {\n            throw new BeanCreationException(\"Could not decode provided Entity Certificate file \"\n                + entityResource.getDescription(), e);\n        }\n    }\n\n    private List<X509Certificate> getCertificates() {\n        if (certificateResources == null) {\n            return new ArrayList<>();\n        }\n\n        val certificates = new LazyList<X509Certificate>();\n        for (val r : certificateResources) {\n            try (val is = r.getInputStream()) {\n                certificates.addAll(X509Support.decodeCertificates(is));\n            } catch (final Exception e) {\n                throw new BeanCreationException(\"Could not decode provided CertificateFile: \" + r.getDescription(), e);\n            }\n        }\n        return certificates;","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-core-api/src/main/java/org/apereo/cas/support/saml/util/credential/BasicX509CredentialFactoryBean.java#L111-L147","documentation":"getEntityCertificate() wraps the whole decode of the entity certificate resource in a try/catch and rethrows any failure as BeanCreationException('Could not decode provided Entity Certificate file <resource>', cause). This means the file could not be read or was not parseable as an X509 certificate (unsupported or corrupt PEM/DER content, or an I/O error). The original exception is preserved as the cause.","triggerScenarios":"entityResource is configured, but entityResource.getInputStream() throws (missing/unreadable file) or X509Support.decodeCertificates() throws (empty file, garbage bytes, non-certificate PEM block, unsupported DER encoding) inside getEntityCertificate().","commonSituations":"Typo in the certificate path or wrong working directory; Docker volume not mounted so the file is absent; file contains the private key PEM or a CSR instead of a certificate; file truncated by a bad copy; permissions deny read; using a .p12/.jks binary where a PEM cert is expected.","solutions":["Check the path in the error message: verify the file exists and is readable at that exact location (ls -l).","Validate the file decodes as a certificate: openssl x509 -in <file> -text -noout; fix contents if it is a key, CSR, or bundle.","Re-copy/export the certificate in PEM (BEGIN CERTIFICATE) or DER form if it is corrupt or truncated.","Fix mount/permission issues (chmod 644, correct Docker volume mount) if the file is missing at runtime."],"exampleFix":"// before: resource points to a private-key PEM\nval entityResource = new FileSystemResource(\"/etc/cas/idp.key\")\n// after: point to the actual certificate\nval entityResource = new FileSystemResource(\"/etc/cas/idp.crt\")","handlingStrategy":"try-catch","validationCode":"// validate readability and decodability before configuring the bean\ntry (var is = entityResource.getInputStream()) {\n    if (X509Support.decodeCertificates(is).isEmpty()) {\n        throw new IllegalStateException(\"No certificate could be decoded from \" + entityResource.getDescription());\n    }\n} catch (Exception e) {\n    throw new IllegalStateException(\"Entity certificate missing or unparseable: \" + entityResource, e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    credentialFactory.getObject();\n} catch (BeanCreationException e) {\n    if (e.getMessage().startsWith(\"Could not decode provided Entity Certificate file\")) {\n        // inspect e.getCause(): IOException => path/permissions; CertificateException => bad content\n        logger.error(\"Fix entityCertificate path or PEM content\", e.getCause());\n    }\n    throw e;\n}","preventionTips":["Run `openssl x509 -in <file> -noout` in CI/deploy scripts to catch corrupt or wrong-type files early.","Mount secret files into containers before startup and verify existence in the entrypoint script.","Store certificates in PEM (BEGIN CERTIFICATE) format; convert DER/PKCS12 explicitly before use.","Watch file permissions (readable by the CAS process user) when secrets are provisioned at runtime."],"tags":["spring","saml","x509","file-read","pem"],"backgroundTag":"file-read-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}