{"record":{"id":"5413d61da3552889","repo":"quarkusio/quarkus","slug":"leaf-certificate-has-no-uri-subject-alternative-na","errorCode":null,"errorMessage":"Leaf certificate has no URI Subject Alternative Names","messagePattern":"Leaf certificate has no URI Subject Alternative Names","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java","lineNumber":177,"sourceCode":"        }\n        return null;\n    }\n\n    private static String extractAndValidateUriSan(X509Certificate leaf) throws SpiffeConnectionException {\n        try {\n            var sans = leaf.getSubjectAlternativeNames();\n            if (sans == null || sans.isEmpty()) {\n                throw new SpiffeConnectionException(\"Leaf certificate has no Subject Alternative Names\");\n            }\n            List<String> uriSans = new ArrayList<>();\n            for (var san : sans) {\n                if (san.size() > 1 && san.get(0) instanceof Integer type && type == URI_SAN_TYPE\n                        && san.get(1) != null) {\n                    uriSans.add(san.get(1).toString());\n                }\n            }\n            if (uriSans.isEmpty()) {\n                throw new SpiffeConnectionException(\"Leaf certificate has no URI Subject Alternative Names\");\n            }\n            if (uriSans.size() > 1) {\n                throw new SpiffeConnectionException(\n                        \"Leaf certificate must contain exactly one URI SAN, found \" + uriSans.size() + \": \" + uriSans);\n            }\n            return uriSans.get(0);\n        } catch (SpiffeConnectionException e) {\n            throw e;\n        } catch (Exception e) {\n            throw new SpiffeConnectionException(\"Failed to extract URI SAN from leaf certificate\", e);\n        }\n    }\n\n    private static boolean isValidTrustDomainChar(char c) {\n        return (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c == '.' || c == '-' || c == '_';\n    }\n\n    private static boolean isValidPathChar(char c) {","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java#L159-L195","documentation":"The leaf certificate has SAN entries, but none of them is of type URI (type 7). SPIFFE requires exactly one URI SAN holding the spiffe:// identity; DNS/IP SANs alone do not qualify. The certificate is therefore not a valid SVID.","triggerScenarios":"extractAndValidateUriSan collects only SAN entries whose type equals URI_SAN_TYPE; when none exist (e.g. only dNSName entries) it throws this error during validateLeaf.","commonSituations":"Certificates generated with only DNS SANs (typical TLS server certs) are used where SPIFFE SVIDs are expected; migration from traditional mTLS to SPIFFE where old certificates remain deployed.","solutions":["Issue a proper SPIFFE X.509 SVID with a URI SAN of the form spiffe://<trust-domain>/<path>.","Replace legacy DNS-SAN-only certificates at the server side with SVIDs from your SPIRE/Workload API.","Check CA certificate profiles to guarantee the SAN type is uniformResourceIdentifier (7)."],"exampleFix":"// before\n//   subjectAltName = DNS:svc.example.com\n// after\n//   subjectAltName = URI:spiffe://example.org/ns/default/sa/svc","handlingStrategy":"validation","validationCode":"boolean hasUriSan(X509Certificate cert) throws Exception {\n    var sans = cert.getSubjectAlternativeNames();\n    if (sans == null) return false;\n    return sans.stream().anyMatch(s -> s.size() > 1 && Integer.valueOf(6).equals(s.get(0)));\n}","typeGuard":null,"tryCatchPattern":"try {\n    validator.validateLeaf(chain);\n} catch (SpiffeConnectionException e) {\n    throw new IllegalStateException(\"SVID lacks a URI SAN — reissue from SPIRE: \" + e.getMessage(), e);\n}","preventionTips":["Request SVIDs only from a SPIFFE-compatible CA (SPIRE, etc.).","Audit certificate templates to emit uniformResourceIdentifier SANs.","Replace legacy mTLS certs when moving a service behind SPIFFE authentication."],"tags":["spiffe","certificate","x509","san"],"backgroundTag":"certificate-missing-uri-san","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}