{"record":{"id":"158183bbeccde961","repo":"apereo/cas","slug":"error-parsing-certificate-for-subject-alt-names","errorCode":null,"errorMessage":"Error parsing certificate for subject alt names [{}]: [{}]","messagePattern":"Error parsing certificate for subject alt names \\[(.+?)\\]: \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/principal/X509ExtractorUtils.java","lineNumber":115,"sourceCode":"        }\n        return subjectAltNames\n                .stream()\n                .filter(name -> name.size() == 2 && (Integer) name.getFirst() == SAN_RFC822_EMAIL_TYPE)\n                .findFirst()\n                .map(objects -> (String) objects.get(1));\n    }\n\n    /**\n     * Get subject alt names without checked exception.\n     * @param certificate x509 certificate\n     * @return subject alternative names as collection of two item lists, empty collection if null or error\n     */\n    public Collection<List<?>> getSubjectAltNames(final X509Certificate certificate) {\n        try {\n            val subjectAltNames = certificate.getSubjectAlternativeNames();\n            return subjectAltNames != null ? subjectAltNames : CollectionUtils.emptyCollection();\n        } catch (final CertificateParsingException e) {\n            LOGGER.warn(\"Error parsing certificate for subject alt names [{}]: [{}]\", certificate.getSubjectDN(), e.getMessage(), e);\n            return CollectionUtils.emptyCollection();\n        }\n    }\n}\n","sourceCodeStart":97,"sourceCodeEnd":120,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/principal/X509ExtractorUtils.java#L97-L120","documentation":"This warning is logged when X.509Certificate.getSubjectAlternativeNames() throws a CertificateParsingException while extracting subject alt names from a client certificate. The method catches the exception, logs the certificate's subject DN and the parse error message, and returns an empty collection instead of propagating the failure. The certificate is still usable elsewhere; only SAN extraction failed.","triggerScenarios":"Calling getSubjectAltNames(X509Certificate) on a certificate whose SAN extension is malformed, encoded in an unexpected/unrecognized GeneralName form, or otherwise fails ASN.1 parsing inside getSubjectAlternativeNames().","commonSituations":"Client certificates issued by unusual/non-compliant CAs or embedded devices with hand-rolled encoders; certificates whose SAN extension uses GeneralName types the JCE parser cannot decode; corrupted or truncated certificates pulled from keystores, smart cards, or PEM conversion.","solutions":["Inspect the offending certificate with 'keytool -printcert -file cert.pem' or 'openssl x509 -text' to see whether the SAN extension is malformed.","Regenerate/reissue the certificate from a standards-compliant CA (e.g. ensure SANs are created with proper GeneralName encoding via keytool -ext or openssl -addext).","Verify the JDK/BouncyCastle provider versions; upgrade to a JCE provider that parses the SAN GeneralName types in question.","If the SANs are genuinely unusable, accept the empty-collection fallback and rely on the certificate's subject DN/RDNs for principal resolution instead."],"exampleFix":"// before\nCollection<List<?>> sans = X509ExtractorUtils.getSubjectAltNames(cert);\nif (sans.isEmpty()) { throw new IllegalArgumentException(\"no SANs\"); }\n// after\nCollection<List<?>> sans = X509ExtractorUtils.getSubjectAltNames(cert);\nif (sans.isEmpty()) {\n    // fall back to subject DN instead of hard-failing\n    sans = X509ExtractorUtils.extractPrincipalFromRfc822Name(cert);\n}","handlingStrategy":"fallback","validationCode":"boolean hasSanExtension(X509Certificate c) {\n    return c.getExtensionValue(\"2.5.29.17\") != null;\n}","typeGuard":"Collection<List<?>> safeSans = cert.getSubjectAlternativeNames() == null\n        ? java.util.CollectionUtils.emptyCollection()\n        : cert.getSubjectAlternativeNames();","tryCatchPattern":"try {\n    var sans = X509ExtractorUtils.getSubjectAltNames(cert);\n    // use sans (may be empty)\n} catch (GeneralSecurityException e) {\n    LOGGER.warn(\"SAN extraction failed for [{}]; falling back to subject DN\", cert.getSubjectDN(), e);\n    // fall back to principal from subject DN\n}","preventionTips":["Issue certificates with standards-compliant SAN encoding from a reputable CA.","Validate client certificates with openssl x509 -text before deploying them.","Keep the JDK/BouncyCastle provider up to date for broad GeneralName support.","Design principal resolution to tolerate empty SANs via subject DN fallback."],"tags":["x509","certificate","parsing","logging"],"backgroundTag":"schema-validation-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}