{"record":{"id":"2d7c952c9b115e60","repo":"quarkusio/quarkus","slug":"failed-to-extract-uri-san-from-leaf-certificate","errorCode":null,"errorMessage":"Failed to extract URI SAN from leaf certificate","messagePattern":"Failed to extract URI SAN from leaf certificate","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java","lineNumber":187,"sourceCode":"            List<String> uriSans = new ArrayList<>();\n            for (var san : sans) {\n                if (san.size() > 1 && san.get(0) instanceof Integer type && type == URI_SAN_TYPE\n                        && san.get(1) != null) {\n                    uriSans.add(san.get(1).toString());\n                }\n            }\n            if (uriSans.isEmpty()) {\n                throw new SpiffeConnectionException(\"Leaf certificate has no URI Subject Alternative Names\");\n            }\n            if (uriSans.size() > 1) {\n                throw new SpiffeConnectionException(\n                        \"Leaf certificate must contain exactly one URI SAN, found \" + uriSans.size() + \": \" + uriSans);\n            }\n            return uriSans.get(0);\n        } catch (SpiffeConnectionException e) {\n            throw e;\n        } catch (Exception e) {\n            throw new SpiffeConnectionException(\"Failed to extract URI SAN from leaf certificate\", e);\n        }\n    }\n\n    private static boolean isValidTrustDomainChar(char c) {\n        return (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c == '.' || c == '-' || c == '_';\n    }\n\n    private static boolean isValidPathChar(char c) {\n        return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9')\n                || c == '.' || c == '-' || c == '_';\n    }\n}\n","sourceCodeStart":169,"sourceCodeEnd":200,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java#L169-L200","documentation":"While reading the leaf certificate's Subject Alternative Names an unexpected exception occurred (e.g. CertificateParsingException), and it is wrapped in this SpiffeConnectionException. This means SAN extraction itself failed, not that the SAN content was invalid.","triggerScenarios":"The generic catch block in extractAndValidateUriSan wraps any non-SpiffeConnectionException thrown by leaf.getSubjectAlternativeNames() or by iterating the SAN collection during validateLeaf.","commonSituations":"See trigger scenarios.","solutions":["Inspect the cause chain (the wrapped exception) to see the underlying parsing error.","Re-fetch/refresh the trust bundle and certificates — the served certificate may be corrupted or truncated.","Validate the certificate chain offline with openssl x509 -text to pinpoint the malformed extension."],"exampleFix":"// inspect the served cert outside the app\n// before: app fails at handshake\n// after: openssl s_client -connect host:port | openssl x509 -text -noout | grep -A5 'Alternative'","handlingStrategy":"try-catch","validationCode":"boolean isParsable(X509Certificate cert) {\n    try { cert.getSubjectAlternativeNames(); return true; }\n    catch (Exception e) { return false; }\n}","typeGuard":null,"tryCatchPattern":"try {\n    validator.validateLeaf(chain);\n} catch (SpiffeConnectionException e) {\n    Throwable cause = e.getCause();\n    log.errorf(e, \"SAN extraction failed: %s\", cause == null ? e.getMessage() : cause.toString());\n}","preventionTips":["Always inspect getCause() to find the underlying parsing error.","Refresh trust bundles / SVIDs if the served certificate appears corrupted.","Validate certificates with openssl when parsing failures recur."],"tags":["spiffe","certificate","parsing","x509"],"backgroundTag":"certificate-parsing-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}