{"record":{"id":"2a5a54264bc12ca4","repo":"quarkusio/quarkus","slug":"x-509-svid-response-from-spire-agent-has-empty-cer","errorCode":null,"errorMessage":"X.509-SVID response from SPIRE agent has empty certificate chain","messagePattern":"X\\.509-SVID response from SPIRE agent has empty certificate chain","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":293,"sourceCode":"\n        record WorkloadJsonWebTokenImpl(String token, String subject, Set<String> audience,\n                Instant expiry) implements WorkloadJsonWebToken {\n        }\n        return new WorkloadJsonWebTokenImpl(token, sub, Set.copyOf(audience), expiry);\n    }\n\n    private static WorkloadCertificateDocument toWorkloadCertificate(X509SVIDResponse response)\n            throws SpiffeConnectionException {\n        List<X509SVID> svids = response.getSvidsList();\n        if (svids.isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent contains no SVIDs\");\n        }\n        X509SVID svid = svids.get(0);\n\n        String protoSpiffeId = svid.getSpiffeId();\n        SpiffeValidator.validateSpiffeId(protoSpiffeId);\n        if (svid.getX509Svid().isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent has empty certificate chain\");\n        }\n        if (svid.getX509SvidKey().isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent has empty private key\");\n        }\n        if (svid.getBundle().isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent has empty trust bundle\");\n        }\n\n        List<X509Certificate> certChain = parseCertificates(svid.getX509Svid().toByteArray(), \"certificate chain\");\n        if (certChain.isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID certificate chain is empty\");\n        }\n\n        X509Certificate leaf = certChain.get(0);\n        String sanSpiffeId = SpiffeValidator.validateLeaf(leaf);\n        if (!protoSpiffeId.equals(sanSpiffeId)) {\n            throw new SpiffeConnectionException(\n                    \"X.509-SVID proto SPIFFE ID does not match the leaf certificate URI SAN; proto: \"","sourceCodeStart":275,"sourceCodeEnd":311,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L275-L311","documentation":"The first X.509-SVID in the SPIRE agent response carried an empty x509_svid (certificate chain) field. The Workload API contract requires each SVID to include its DER-encoded certificate chain; the client treats the response as malformed rather than proceeding without certificates.","triggerScenarios":"getWorkloadCertificate when the selected X509SVID's getX509Svid() ByteString is empty, even though the svids list itself is non-empty.","commonSituations":"A malformed or incompatible SPIRE agent version responding incorrectly; a proxy/interceptor zeroing fields; protobuf decoding issue from a mismatched Workload API version.","solutions":["Upgrade/downgrade the SPIRE agent to a version compatible with the SPIRE server (spire-agent version vs spire-server version).","Ensure the client talks directly to the real Workload API socket, not a proxy that truncates messages.","Re-fetch the certificate; if persistent, restart the SPIRE agent so it re-attests and repopulates SVIDs.","Check agent logs for Workload API errors when serving this workload UID."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    doc = client.getWorkloadCertificate();\n} catch (SpiffeConnectionException e) {\n    if (e.getMessage().contains(\"empty certificate chain\")) {\n        doc = retryWithBackoff(client::getWorkloadCertificate);\n    } else throw e;\n}","preventionTips":["Keep SPIRE agent and server on compatible versions","Avoid proxies on the Workload API socket path","Restart the agent if it serves malformed SVIDs","Monitor agent health and re-attestation events"],"tags":["spiffe","spire","x509","malformed-response"],"backgroundTag":"malformed-workload-api-response","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}