{"record":{"id":"64597d8e9b38e3a0","repo":"quarkusio/quarkus","slug":"x-509-svid-response-from-spire-agent-contains-an-i-64597d","errorCode":null,"errorMessage":"X.509-SVID response from SPIRE agent contains an invalid ${description}","messagePattern":"X\\.509-SVID response from SPIRE agent contains an invalid (.+?)","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":354,"sourceCode":"        if (derBytes.length == 0) {\n            throw new SpiffeConnectionException(\"X.509-SVID response contains empty \" + description);\n        }\n        try {\n            CertificateFactory cf = CertificateFactory.getInstance(\"X.509\");\n            Collection<?> certs = cf.generateCertificates(new ByteArrayInputStream(derBytes));\n            List<X509Certificate> result = new ArrayList<>(certs.size());\n            for (var cert : certs) {\n                if (cert instanceof X509Certificate x509) {\n                    result.add(x509);\n                } else {\n                    throw new SpiffeConnectionException(\n                            \"X.509-SVID response from SPIRE agent contains a non-X.509 certificate in \"\n                                    + description + \": \" + cert.getClass().getName());\n                }\n            }\n            return result;\n        } catch (Exception e) {\n            throw new SpiffeConnectionException(\n                    \"X.509-SVID response from SPIRE agent contains an invalid \" + description, e);\n        }\n    }\n\n    private static List<String> certsToPem(List<X509Certificate> certs) {\n        try {\n            List<String> result = new ArrayList<>(certs.size());\n            for (X509Certificate cert : certs) {\n                result.add(toPem(\"CERTIFICATE\", cert.getEncoded()));\n            }\n            return unmodifiableList(result);\n        } catch (CertificateEncodingException e) {\n            throw new IllegalStateException(\"Failed to encode certificate to PEM\", e);\n        }\n    }\n\n    private static String toPem(String type, byte[] der) {\n        return \"-----BEGIN \" + type + \"-----\\n\"","sourceCodeStart":336,"sourceCodeEnd":372,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L336-L372","documentation":"When parsing an X.509-SVID response fetched from the local SPIRE agent, the workload API returned data that could not be interpreted as a valid certificate chain or trust bundle for the requested type (leaf chain or trust bundle). The library wraps the underlying parsing/DER-decoding exception in a SpiffeConnectionException describing which part (the 'description' argument) was invalid. This indicates the SPIRE agent returned structurally corrupt or non-X.509 data.","triggerScenarios":"Calling X509SvidFetcher.fetchX509Svids or X509BundleFetcher.fetchX509Bundles over the Workload API stream when the agent's protobuf payload decodes to bytes that fail CertificateFactory.generateCertificates, or a decoded entry is not an X509Certificate instance.","commonSituations":"A broken/incompatible SPIRE agent version emitting unexpected payload contents; a misconfigured socket path connecting to a non-SPIRE service that returns garbage on the stream; corrupted responses due to proxy or socket interception.","solutions":["Verify you are connecting to a genuine SPIRE agent socket (check quarkus.spiffe.trust-domain, socket path and that spire-agent is running).","Upgrade or restart the SPIRE agent and confirm it serves healthy SVIDs (spire-agent api fetch x509).","Catch SpiffeConnectionException and log the cause (the wrapped exception) to identify the malformed data source.","Ensure no proxy/firewall/antivirus is intercepting the unix or tcp socket connection to the agent."],"exampleFix":"// before\nList<X509Certificate> chain = SpiffeClientHolder.get().getWorkloadCertificates();\n// after\ntry {\n    List<X509Certificate> chain = SpiffeClientHolder.get().getWorkloadCertificates();\n} catch (SpiffeConnectionException e) {\n    LOG.errorf(e, \"SPIRE agent returned invalid X.509 data; cause=%s\", e.getCause());\n}","handlingStrategy":"try-catch","validationCode":"// verify agent reachability before relying on the client\nSocketAddress addr = SpiffeClientHolder.get().getSocket(); // must connect to a real SPIRE agent\n// pre-check with spire-agent CLI or HealthCheck if exposed","typeGuard":null,"tryCatchPattern":"try {\n    List<String> pem = SpiffeClientHolder.get().getWorkloadCertificatesPem();\n} catch (SpiffeConnectionException e) {\n    log.errorf(e.getCause(), \"Invalid X.509 data from SPIRE agent\");\n    throw new IllegalStateException(\"SPIRE workload API returned malformed certificates\", e);\n}","preventionTips":["Confirm the configured socket address points at a real SPIRE agent","Pin and test a known-good SPIRE agent version","Log e.getCause() — it holds the underlying parse error","Exclude proxies/interceptors from the agent socket path"],"tags":["spiffe","x509","certificate-parsing","workload-api"],"backgroundTag":"x509-certificate-parse-error","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}