{"record":{"id":"5513ceb5735f6ff9","repo":"quarkusio/quarkus","slug":"x-509-svid-response-from-spire-agent-contains-an-i","errorCode":null,"errorMessage":"X.509-SVID response from SPIRE agent contains an invalid private key","messagePattern":"X\\.509-SVID response from SPIRE agent contains an invalid private key","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":324,"sourceCode":"\n        X509Certificate leaf = certChain.get(0);\n        String sanSpiffeId = SpiffeValidator.validateLeaf(leaf);\n        if (!protoSpiffeId.equals(sanSpiffeId)) {\n            throw new SpiffeConnectionException(\n                    \"X.509-SVID proto SPIFFE ID does not match the leaf certificate URI SAN; proto: \"\n                            + protoSpiffeId + \", SAN: \" + sanSpiffeId);\n        }\n        for (int i = 1; i < certChain.size(); i++) {\n            SpiffeValidator.validateIntermediate(certChain.get(i));\n        }\n\n        String keyAlgorithm = leaf.getPublicKey().getAlgorithm();\n        PrivateKey privateKey;\n        try {\n            privateKey = KeyFactory.getInstance(keyAlgorithm)\n                    .generatePrivate(new PKCS8EncodedKeySpec(svid.getX509SvidKey().toByteArray()));\n        } catch (Exception e) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent contains an invalid private key\", e);\n        }\n\n        List<X509Certificate> trustBundle = parseCertificates(svid.getBundle().toByteArray(), \"trust bundle\");\n\n        var keyMaterial = new WorkloadCertificateChainImpl(unmodifiableList(certChain), privateKey);\n        var trustMaterial = new WorkloadTrustBundleImpl(unmodifiableList(trustBundle));\n        return new WorkloadCertificateDocumentImpl(protoSpiffeId, keyMaterial, trustMaterial);\n    }\n\n    private static List<X509Certificate> parseCertificates(byte[] derBytes, String description)\n            throws SpiffeConnectionException {\n        if (derBytes.length == 0) {\n            throw new SpiffeConnectionException(\"X.509-SVID response contains empty \" + description);\n        }\n        try {\n            CertificateFactory cf = CertificateFactory.getInstance(\"X.509\");\n            Collection<?> certs = cf.generateCertificates(new ByteArrayInputStream(derBytes));\n            List<X509Certificate> result = new ArrayList<>(certs.size());","sourceCodeStart":306,"sourceCodeEnd":342,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L306-L342","documentation":"The client attempted to reconstruct a PrivateKey from the SVID's PKCS8 key bytes using the leaf certificate's public key algorithm, and KeyFactory.generatePrivate threw. The key bytes are not a valid PKCS8 encoding for that algorithm, so no usable key material can be produced.","triggerScenarios":"getWorkloadCertificate when KeyFactory.getInstance(leaf.getPublicKey().getAlgorithm()).generatePrivate(new PKCS8EncodedKeySpec(...)) throws (InvalidKeySpecException etc.).","commonSituations":"Non-PKCS8 key format (SEC1/RSA raw) delivered by an old agent; key algorithm not supported by the JDK provider (e.g. exotic EC curves); corrupted key bytes; JVM lacking a provider for the algorithm (e.g. Ed25519 on old JDKs).","solutions":["Check the leaf cert algorithm (openssl x509 -noout -text) and ensure your JDK supports it (Ed25519 needs JDK 15+).","Upgrade SPIRE agent so keys are delivered in PKCS8 form.","Enable an additional security provider (e.g. BouncyCastle) if the algorithm needs one.","Restart the agent / re-request the SVID to rule out corrupted bytes."],"exampleFix":"// before: JDK 11 cannot parse Ed25519 keys\nPrivateKey pk = KeyFactory.getInstance(\"Ed25519\").generatePrivate(spec);\n// after: use a runtime/provider that supports it (JDK 15+) or BouncyCastle\nSecurity.addProvider(new BouncyCastleProvider());","handlingStrategy":"try-catch","validationCode":"// pre-check JDK support for the cert's key algorithm:\nString alg = leaf.getPublicKey().getAlgorithm();\nboolean ok = java.security.Security.getAlgorithms(\"KeyFactory\").contains(alg);\n","typeGuard":null,"tryCatchPattern":"try {\n    doc = client.getWorkloadCertificate();\n} catch (SpiffeConnectionException e) {\n    if (e.getMessage().contains(\"invalid private key\")) {\n        // check JVM/provider support (e.g. Ed25519 needs JDK15+ or BouncyCastle)\n        throw new IllegalStateException(\"JDK cannot parse SVID key: \" + e.getMessage(), e);\n    } else throw e;\n}","preventionTips":["Use JDK 15+ (or add BouncyCastle) if SPIRE issues Ed25519 keys","Keep SPIRE agent versions current (PKCS8 key delivery)","Avoid custom key formats in SPIRE server key configuration","Test SVID parsing in CI with the same JDK as production"],"tags":["spiffe","private-key","pkcs8","cryptography"],"backgroundTag":"invalid-private-key","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}