{"record":{"id":"559ba3db371cc111","repo":"jwtk/jjwt","slug":"x509certificate-encoded-bytes-cannot-be-null-or-em","errorCode":null,"errorMessage":"X509Certificate encoded bytes cannot be null or empty.  Certificate: {${cert}}.","messagePattern":"X509Certificate encoded bytes cannot be null or empty\\.  Certificate: (.+?)\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/JwtX509StringConverter.java","lineNumber":50,"sourceCode":"    // Returns a Base64 encoded (NOT Base64Url encoded) string of the cert's encoded byte array per\n    // https://www.rfc-editor.org/rfc/rfc7515.html#section-4.1.6\n    // https://www.rfc-editor.org/rfc/rfc7516.html#section-4.1.8\n    // https://www.rfc-editor.org/rfc/rfc7517.html#section-4.7\n    @Override\n    public String applyTo(X509Certificate cert) {\n        Assert.notNull(cert, \"X509Certificate cannot be null.\");\n        byte[] der = Bytes.EMPTY;\n        try {\n            try {\n                der = cert.getEncoded();\n            } catch (CertificateEncodingException e) {\n                String msg = \"Unable to access X509Certificate encoded bytes necessary to perform DER \" +\n                        \"Base64-encoding. Certificate: {\" + cert + \"}. Cause: \" + e.getMessage();\n                throw new IllegalArgumentException(msg, e);\n            }\n            if (Bytes.isEmpty(der)) {\n                String msg = \"X509Certificate encoded bytes cannot be null or empty.  Certificate: {\" + cert + \"}.\";\n                throw new IllegalArgumentException(msg);\n            }\n            return Encoders.BASE64.encode(der);\n        } finally {\n            Bytes.clear(der);\n        }\n    }\n\n    // visible for testing\n    protected X509Certificate toCert(final byte[] der) throws SecurityException {\n        return new JcaTemplate(\"X.509\").generateX509Certificate(der);\n    }\n\n    @Override\n    public X509Certificate applyFrom(CharSequence s) {\n        Assert.hasText(s, \"X.509 Certificate encoded string cannot be null or empty.\");\n        try {\n            byte[] der = Decoders.BASE64.decode(s); //RFC requires Base64, not Base64Url\n            return toCert(der);","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/JwtX509StringConverter.java#L32-L68","documentation":"After successfully calling cert.getEncoded(), JwtX509StringConverter.applyTo checks the DER bytes are non-null and non-empty; if not, it throws IllegalArgumentException with this message. A certificate that yields zero-length encoded bytes cannot be represented in the x5c header.","triggerScenarios":"Applying an X509Certificate whose getEncoded() returns an empty byte array when converting it to an x5c header string.","commonSituations":"Defective or mock/stub certificate implementations in tests returning empty encodings; certificates constructed by custom Provider code with uninitialized contents.","solutions":["Replace the certificate with one parsed from real encoded bytes via CertificateFactory.","Verify getEncoded() outside the library and fix the certificate source.","If seen in tests, use a real certificate fixture (PEM file) instead of a stub.","Regenerate the certificate if its encoding is genuinely empty."],"exampleFix":"// before\nX509Certificate cert = mock(X509Certificate.class);\nwhen(cert.getEncoded()).thenReturn(new byte[0]);\n\n// after\nX509Certificate cert = (X509Certificate) CertificateFactory.getInstance(\"X.509\")\n    .generateCertificate(getClass().getResourceAsStream(\"/test-cert.pem\"));","handlingStrategy":"validation","validationCode":"boolean hasNonEmptyEncoding(X509Certificate cert) throws CertificateEncodingException {\n    return cert.getEncoded() != null && cert.getEncoded().length > 0;\n}","typeGuard":null,"tryCatchPattern":"try {\n    String x5c = converter.applyTo(cert);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"encoded bytes cannot be null or empty\")) {\n        // replace the certificate object with a real parsed one\n    } else throw e;\n}","preventionTips":["Use real certificate fixtures instead of stubs/mocks in tests.","Verify getEncoded() on certificates loaded from untrusted code paths."],"tags":["x509","certificate","empty-bytes","jsonwebtoken"],"backgroundTag":"empty-required-field","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}