{"record":{"id":"2a7611ece9e3d7f9","repo":"quarkusio/quarkus","slug":"jwk-with-the-certificate-thumbprint-s-is-not-av","errorCode":null,"errorMessage":"JWK with the certificate thumbprint '%s' is not available","messagePattern":"JWK with the certificate thumbprint '(.+?)' is not available","errorType":"exception","errorClass":"org.jose4j.keys.resolvers.UnresolvableKeyException","httpStatus":401,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcProvider.java","lineNumber":577,"sourceCode":"            if (key == null) {\n                thumbprint = jws.getHeader(HeaderParameterNames.X509_CERTIFICATE_SHA256_THUMBPRINT);\n                if (thumbprint != null) {\n                    key = getKeyWithS256Thumbprint(thumbprint);\n                    if (key == null) {\n                        // if only `x5tS256` was set then the key must exist\n                        throw new UnresolvableKeyException(\n                                String.format(\"JWK with the SHA256 certificate thumbprint '%s' is not available\", thumbprint));\n                    }\n                }\n            }\n\n            if (key == null) {\n                thumbprint = jws.getHeader(HeaderParameterNames.X509_CERTIFICATE_THUMBPRINT);\n                if (thumbprint != null) {\n                    key = getKeyWithThumbprint(thumbprint);\n                    if (key == null) {\n                        // if only `x5t` was set then the key must exist\n                        throw new UnresolvableKeyException(\n                                String.format(\"JWK with the certificate thumbprint '%s' is not available\", thumbprint));\n                    }\n                }\n            }\n\n            if (key == null && kid == null && thumbprint == null) {\n                try {\n                    key = jwks.getKeyWithoutKeyIdAndThumbprint(jws.getKeyType());\n                } catch (InvalidAlgorithmException ex) {\n                    LOG.debug(\"Token 'alg'(algorithm) header value is invalid\", ex);\n                }\n            }\n\n            if (key == null && oidcConfig.jwks().tryAll() && kid == null && thumbprint == null) {\n                LOG.debug(\"JWK is not available, neither 'kid' nor 'x5t#S256' nor 'x5t' token headers are set,\"\n                        + \" falling back to trying all available keys\");\n                key = jwks.findKeyInAllKeys(jws);\n            }","sourceCodeStart":559,"sourceCodeEnd":595,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcProvider.java#L559-L595","documentation":"Thrown by OidcProvider's JsonWebKeyResolver.resolveKey when the token has no 'kid' and no 'x5t#S256', but carries the legacy 'x5t' (SHA-1 certificate thumbprint) header, and no JWK matches that thumbprint. As with the other thumbprint branch, when only 'x5t' is set the exact key must exist; otherwise UnresolvableKeyException is thrown.","triggerScenarios":"Verifying a JWT whose header contains 'x5t' (SHA-1 thumbprint, no 'kid', no 'x5t#S256') while getKeyWithThumbprint(thumbprint) returns null against the tenant's key set.","commonSituations":"Older identity providers or Java-based signers that emit SHA-1 'x5t' while the JWKS exposes x5c entries whose SHA-1 thumbprint doesn't match (wrong cert in chain); tokens cross-issued between environments; provider republished certs after rotation without the app refreshing JWKS.","solutions":["Confirm the SHA-1 thumbprint of the JWKS entry's x5c certificate equals the token's 'x5t' value","Refresh the cached JWKS after provider certificate rotation","Ask the issuer to sign with 'kid' or 'x5t#S256' headers, which Quarkus prefers","Pin the signing certificate locally via quarkus.oidc.token.certificate-chain if the provider's JWKS is unreliable"],"exampleFix":"// token x5t (SHA-1) 'XyZ...' mismatched with republished cert\n// after: refresh JWKS or pin:\nquarkus.oidc.token.certificate-chain=...","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    return validate(token);\n} catch (AuthenticationFailedException e) {\n    if (String.valueOf(e.getCause()).contains(\"certificate thumbprint\")) {\n        // try local pinned cert or request JWKS refresh\n        return verifyWithPinnedCert(token);\n    }\n    throw e;\n}","preventionTips":["Confirm the issuer's SHA-1 x5t matches the x5c leaf cert after any rotation","Migrate issuers to 'kid' or 'x5t#S256' headers","Pin certificates locally via quarkus.oidc.token.certificate-chain when JWKS is unreliable"],"tags":["jwt","oidc","x509","thumbprint","sha1"],"backgroundTag":"jwk-thumbprint-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}