{"record":{"id":"35559b322a1dbfdd","repo":"apereo/cas","slug":"none-of-the-trustmanagers-trust-this-server-certif","errorCode":null,"errorMessage":"None of the TrustManagers trust this server certificate chain","messagePattern":"None of the TrustManagers trust this server certificate chain","errorType":"exception","errorClass":"CertificateException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/ssl/CompositeX509TrustManager.java","lineNumber":60,"sourceCode":"        }\n    }\n\n    @Override\n    public void checkServerTrusted(final X509Certificate[] chain, final String authType) throws CertificateException {\n        val trusted = trustManagers.stream().anyMatch(trustManager -> {\n            try {\n                trustManager.checkServerTrusted(chain, authType);\n                return true;\n            } catch (final CertificateException e) {\n                if (LOGGER.isDebugEnabled()) {\n                    val certs = Arrays.stream(chain).map(Certificate::toString).collect(Collectors.toSet());\n                    LOGGER.debug(\"Unable to trust the server certificates [{}] for auth type [{}]: [{}]\", certs, authType, e);\n                }\n                return false;\n            }\n        });\n        if (!trusted) {\n            throw new CertificateException(\"None of the TrustManagers trust this server certificate chain\");\n        }\n    }\n\n    @Override\n    public X509Certificate[] getAcceptedIssuers() {\n        val certificates = new ArrayList<X509Certificate>(trustManagers.size());\n        this.trustManagers.forEach(trustManager ->\n            certificates.addAll(CollectionUtils.wrapList(trustManager.getAcceptedIssuers())));\n        return certificates.toArray(X509Certificate[]::new);\n    }\n\n}\n","sourceCodeStart":42,"sourceCodeEnd":73,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/ssl/CompositeX509TrustManager.java#L42-L73","documentation":"CompositeX509TrustManager delegates checkServerTrusted to each configured trust manager; none trusted the remote server's certificate chain, so CertificateException is thrown. The input at fault is the server's X509 chain — typically an unknown/self-signed CA, expired cert, or missing intermediates.","triggerScenarios":"Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/ssl/CompositeX509TrustManager.java:60 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Import the server's CA certificate into a configured trust store","Ensure the server sends the full intermediate chain","Enable debug logging to inspect per-manager validation failures","Check for expired/renamed server certificates"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}