{"record":{"id":"36619565e00e5f0b","repo":"quarkusio/quarkus","slug":"failed-to-encode-certificate-to-pem","errorCode":null,"errorMessage":"Failed to encode certificate to PEM","messagePattern":"Failed to encode certificate to PEM","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":367,"sourceCode":"                                    + description + \": \" + cert.getClass().getName());\n                }\n            }\n            return result;\n        } catch (Exception e) {\n            throw new SpiffeConnectionException(\n                    \"X.509-SVID response from SPIRE agent contains an invalid \" + description, e);\n        }\n    }\n\n    private static List<String> certsToPem(List<X509Certificate> certs) {\n        try {\n            List<String> result = new ArrayList<>(certs.size());\n            for (X509Certificate cert : certs) {\n                result.add(toPem(\"CERTIFICATE\", cert.getEncoded()));\n            }\n            return unmodifiableList(result);\n        } catch (CertificateEncodingException e) {\n            throw new IllegalStateException(\"Failed to encode certificate to PEM\", e);\n        }\n    }\n\n    private static String toPem(String type, byte[] der) {\n        return \"-----BEGIN \" + type + \"-----\\n\"\n                + PEM_ENCODER.encodeToString(der)\n                + \"\\n-----END \" + type + \"-----\\n\";\n    }\n\n    private record WorkloadCertificateDocumentImpl(String subject, WorkloadCertificateChainImpl certificateChain,\n            WorkloadTrustBundleImpl trustBundle) implements WorkloadCertificateDocument {\n    }\n\n    private record WorkloadCertificateChainImpl(List<X509Certificate> chain,\n            PrivateKey privateKey) implements WorkloadCertificateChain {\n\n        @Override\n        public List<String> chainPem() {","sourceCodeStart":349,"sourceCodeEnd":385,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L349-L385","documentation":"After successfully parsing certificates from the SPIRE Workload API response, the library converts each X509Certificate to PEM for downstream consumers via cert.getEncoded(). If the certificate provider refuses to DER-encode a certificate (CertificateEncodingException), an IllegalStateException is thrown. This is rare and indicates an internal certificate object inconsistency rather than a configuration problem.","triggerScenarios":"certsToPem invoked by getWorkloadCertificates()/getTrustBundle() PEM conversions when X509Certificate.getEncoded() raises CertificateEncodingException (e.g., a malformed certificate implementation from a non-default security provider).","commonSituations":"A custom JCA security provider registered on the JVM that parses certificates into non-standard implementations; corrupted agent responses that partially parse but cannot re-encode; exotic JDK/provider combinations.","solutions":["Check for custom java.security providers (Security.getProviders()) that override X.509 parsing and remove/fix them.","Restart the SPIRE agent and retry — a transient corrupted response usually re-parses cleanly.","Catch IllegalStateException and surface it as an application startup failure with the cause logged.","Report to the extension maintainers if reproducible with the standard SunX509 provider."],"exampleFix":"// before\nString pem = SpiffeClientHolder.get().getWorkloadCertificatesPem().get(0);\n// after\ntry {\n    String pem = SpiffeClientHolder.get().getWorkloadCertificatesPem().get(0);\n} catch (IllegalStateException e) {\n    throw new RuntimeException(\"Certificate PEM encoding failed: \" + e.getCause(), e);\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    List<String> pem = SpiffeClientHolder.get().getTrustBundlePem();\n} catch (IllegalStateException e) {\n    log.errorf(e.getCause(), \"Certificate could not be DER-encoded\");\n    throw new IllegalStateException(\"PEM conversion failed; check security providers\", e);\n}","preventionTips":["Avoid registering custom X.509 JCA providers in the application","Retry once on transient corruption from the agent","Report persistent occurrences with the wrapped cause to maintainers","Keep on a standard JDK (e.g. Temurin) to avoid provider quirks"],"tags":["spiffe","pem","certificate-encoding","jce"],"backgroundTag":"certificate-encoding-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}