{"record":{"id":"6bd564daf11133a9","repo":"jwtk/jjwt","slug":"unable-to-access-x509certificate-encoded-bytes-nec","errorCode":null,"errorMessage":"Unable to access X509Certificate encoded bytes necessary to perform DER Base64-encoding. Certificate: {${cert}}. Cause: ${e.getMessage()}","messagePattern":"Unable to access X509Certificate encoded bytes necessary to perform DER Base64-encoding\\. Certificate: (.+?)\\. Cause: (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/JwtX509StringConverter.java","lineNumber":46,"sourceCode":"public class JwtX509StringConverter implements Converter<X509Certificate, CharSequence> {\n\n    public static final JwtX509StringConverter INSTANCE = new JwtX509StringConverter();\n\n    // Returns a Base64 encoded (NOT Base64Url encoded) string of the cert's encoded byte array per\n    // https://www.rfc-editor.org/rfc/rfc7515.html#section-4.1.6\n    // https://www.rfc-editor.org/rfc/rfc7516.html#section-4.1.8\n    // https://www.rfc-editor.org/rfc/rfc7517.html#section-4.7\n    @Override\n    public String applyTo(X509Certificate cert) {\n        Assert.notNull(cert, \"X509Certificate cannot be null.\");\n        byte[] der = Bytes.EMPTY;\n        try {\n            try {\n                der = cert.getEncoded();\n            } catch (CertificateEncodingException e) {\n                String msg = \"Unable to access X509Certificate encoded bytes necessary to perform DER \" +\n                        \"Base64-encoding. Certificate: {\" + cert + \"}. Cause: \" + e.getMessage();\n                throw new IllegalArgumentException(msg, e);\n            }\n            if (Bytes.isEmpty(der)) {\n                String msg = \"X509Certificate encoded bytes cannot be null or empty.  Certificate: {\" + cert + \"}.\";\n                throw new IllegalArgumentException(msg);\n            }\n            return Encoders.BASE64.encode(der);\n        } finally {\n            Bytes.clear(der);\n        }\n    }\n\n    // visible for testing\n    protected X509Certificate toCert(final byte[] der) throws SecurityException {\n        return new JcaTemplate(\"X.509\").generateX509Certificate(der);\n    }\n\n    @Override\n    public X509Certificate applyFrom(CharSequence s) {","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/JwtX509StringConverter.java#L28-L64","documentation":"JwtX509StringConverter.applyTo encodes an X509Certificate to a Base64 DER string for the x5c header. If cert.getEncoded() throws CertificateEncodingException (the certificate provider cannot produce its DER encoding), the converter throws IllegalArgumentException with this message, embedding the certificate and cause.","triggerScenarios":"Building a JWS/JWT with an x5c (X.509 certificate chain) header whose certificate's getEncoded() fails, typically because the underlying provider cannot encode the certificate format.","commonSituations":"Certificates loaded from non-standard providers or exotic formats (e.g. a certificate implementation backed by an unsupported provider); corrupted or partially parsed certificate objects; provider mismatch after moving keys between JVM security providers (BouncyCastle vs default SUN).","solutions":["Check the wrapped cause for the provider-level encoding failure and re-load the certificate from its original PEM/DER bytes via CertificateFactory.","Ensure the certificate was parsed by CertificateFactory.getInstance(\"X.509\") from valid encoded bytes.","Add/remove the BouncyCastle provider consistently so the cert's provider can encode it.","Re-generate the certificate if the underlying object is corrupt."],"exampleFix":"// before\nX509Certificate cert = (X509Certificate) customProviderObject; // exotic impl, getEncoded fails\n\n// after\nCertificateFactory cf = CertificateFactory.getInstance(\"X.509\");\nX509Certificate cert = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(pemBytes));","handlingStrategy":"try-catch","validationCode":"boolean hasEncoding(X509Certificate cert) {\n    try { return cert.getEncoded() != null && cert.getEncoded().length > 0; }\n    catch (CertificateEncodingException e) { return false; }\n}","typeGuard":null,"tryCatchPattern":"try {\n    String x5c = converter.applyTo(cert);\n} catch (IllegalArgumentException e) {\n    if (e.getCause() instanceof CertificateEncodingException) {\n        // reload cert from PEM/DER via CertificateFactory\n    } else throw e;\n}","preventionTips":["Always parse certificates with CertificateFactory.getInstance(\"X.509\").","Avoid passing exotic provider-backed certificate objects into JWT building.","Test x5c header building with your real certificates in CI."],"tags":["x509","certificate","encoding","jsonwebtoken"],"backgroundTag":"invalid-argument-value","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}