{"record":{"id":"5d5d21fdde56b3c8","repo":"quarkusio/quarkus","slug":"invalid-certificate-chain","errorCode":null,"errorMessage":"Invalid certificate chain","messagePattern":"Invalid certificate chain","errorType":"exception","errorClass":"UnresolvableKeyException","httpStatus":401,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CertChainPublicKeyResolver.java","lineNumber":106,"sourceCode":"                    LOG.errorf(\"Wrong leaf certificate common name: %s\", leafCertificateName);\n                    throw new UnresolvableKeyException(\"Wrong leaf certificate common name\");\n                }\n            } else if (certificateValidators.isEmpty()) {\n                // No custom validators are registered and no leaf certificate CN is configured\n                // Check that the truststore contains a leaf certificate thumbprint\n                LOG.debug(\"Checking a thumbprint of the leaf chain certificate\");\n                String thumbprint = TrustStoreUtils.calculateThumprint(chain.get(0));\n                if (!thumbprints.contains(thumbprint)) {\n                    LOG.error(\"Thumprint of the leaf chain certificate is invalid\");\n                    throw new UnresolvableKeyException(\"Thumprint of the leaf chain certificate is invalid\");\n                }\n            }\n\n            return chain.get(0).getPublicKey();\n        } catch (UnresolvableKeyException ex) {\n            throw ex;\n        } catch (Exception ex) {\n            throw new UnresolvableKeyException(\"Invalid certificate chain\", ex);\n        }\n    }\n}\n","sourceCodeStart":88,"sourceCodeEnd":110,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CertChainPublicKeyResolver.java#L88-L110","documentation":"This is the catch-all wrapping error in CertChainPublicKeyResolver.resolveKey: any exception during certificate chain processing that is not already an UnresolvableKeyException (e.g. CertificateExpiredException, signature verification failure, malformed x5c data, crypto errors) is wrapped into an UnresolvableKeyException with message 'Invalid certificate chain' and the original exception as cause.","triggerScenarios":"resolveKey() throws from CertificateHelper.checkValidity(chain, null) (expired/not-yet-valid cert, path validation failure), root.verify(root.getPublicKey()) failing for a single-cert chain, or thumbprint calculation errors.","commonSituations":"Expired or not-yet-valid certificates in the token's x5c chain; system clock skew on the Quarkus host; corrupted or mis-encoded x5c header; self-signed single certificate whose self-signature does not verify.","solutions":["Inspect the exception cause in the application log to see the underlying failure (expired cert, signature mismatch, etc.).","Renew the expired certificate on the token issuer side and redeploy/restart the issuer.","Fix clock skew on the Quarkus host (NTP sync) if certificates are rejected as expired/not-yet-valid.","Ensure the issuer embeds a well-formed, complete x5c chain (leaf plus intermediates plus root)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"for (X509Certificate cert : chain) {\n    cert.checkValidity(); // throws CertificateExpiredException / CertificateNotYetValidException early\n}","typeGuard":null,"tryCatchPattern":"try {\n    return jwtVerify(token);\n} catch (UnresolvableKeyException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Invalid certificate chain\")) {\n        log.errorf(\"Chain processing failed: %s\", e.getCause());\n    }\n    throw e;\n}","preventionTips":["Keep host clocks NTP-synced to avoid false expired/not-yet-valid rejections.","Monitor issuer certificate expiry and renew before deadline.","Log the cause chain; the wrapped cause pinpoints the exact certificate problem."],"tags":["oidc","certificate-chain","x509","expired-certificate"],"backgroundTag":"invalid-certificate-chain","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}