{"record":{"id":"643e19772d0e8a61","repo":"apereo/cas","slug":"none-of-the-trustmanagers-can-trust-this-client-ce","errorCode":null,"errorMessage":"None of the TrustManagers can trust this client certificate chain","messagePattern":"None of the TrustManagers can trust this client certificate chain","errorType":"exception","errorClass":"CertificateException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/ssl/CompositeX509TrustManager.java","lineNumber":41,"sourceCode":"    private final List<X509TrustManager> trustManagers;\n\n    @Override\n    public void checkClientTrusted(final X509Certificate[] chain, final String authType) throws CertificateException {\n        val trusted = this.trustManagers.stream().anyMatch(trustManager -> {\n            try {\n                trustManager.checkClientTrusted(chain, authType);\n                return true;\n            } catch (final CertificateException e) {\n                if (LOGGER.isDebugEnabled()) {\n                    val certs = Arrays.stream(chain).map(Certificate::toString).collect(Collectors.toSet());\n                    LOGGER.debug(\"Unable to trust the client certificates [{}] for auth type [{}]: [{}]\", certs, authType, e);\n                }\n                return false;\n            }\n        });\n\n        if (!trusted) {\n            throw new CertificateException(\"None of the TrustManagers can trust this client certificate chain\");\n        }\n    }\n\n    @Override\n    public void checkServerTrusted(final X509Certificate[] chain, final String authType) throws CertificateException {\n        val trusted = trustManagers.stream().anyMatch(trustManager -> {\n            try {\n                trustManager.checkServerTrusted(chain, authType);\n                return true;\n            } catch (final CertificateException e) {\n                if (LOGGER.isDebugEnabled()) {\n                    val certs = Arrays.stream(chain).map(Certificate::toString).collect(Collectors.toSet());\n                    LOGGER.debug(\"Unable to trust the server certificates [{}] for auth type [{}]: [{}]\", certs, authType, e);\n                }\n                return false;\n            }\n        });\n        if (!trusted) {","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/ssl/CompositeX509TrustManager.java#L23-L59","documentation":"CompositeX509TrustManager delegates checkClientTrusted to each configured trust manager; none accepted the presented client certificate chain, so CertificateException is thrown. The input at fault is the client's X509 certificate chain (and auth type), which is not anchored in any of the configured trust stores.","triggerScenarios":"Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/ssl/CompositeX509TrustManager.java:41 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Import the client certificate or its issuing CA into one of the configured trust stores","Check the client is presenting the full chain, not just the leaf","Enable debug logging to see per-trust-manager rejection reasons","Verify the authType/cipher suite negotiation matches the trust manager expectations"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}