{"record":{"id":"7ea05dfaca2e98f6","repo":"grpc/grpc-go","slug":"spiffe-verify-function-could-not-parse-input-cert","errorCode":null,"errorMessage":"spiffe: verify function could not parse input certificate: %v","messagePattern":"spiffe: verify function could not parse input certificate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/bootstrap/tlscreds/bundle.go","lineNumber":166,"sourceCode":"func (c *reloadingCreds) Clone() credentials.TransportCredentials {\n\treturn &reloadingCreds{provider: c.provider}\n}\n\nfunc (c *reloadingCreds) OverrideServerName(string) error {\n\treturn errors.New(\"overriding server name is not supported by xDS client TLS credentials\")\n}\n\nfunc (c *reloadingCreds) ServerHandshake(net.Conn) (net.Conn, credentials.AuthInfo, error) {\n\treturn nil, nil, errors.New(\"server handshake is not supported by xDS client TLS credentials\")\n}\n\nfunc buildSPIFFEVerifyFunc(spiffeBundleMap map[string]*spiffebundle.Bundle) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {\n\treturn func(rawCerts [][]byte, _ [][]*x509.Certificate) error {\n\t\trawCertList := make([]*x509.Certificate, len(rawCerts))\n\t\tfor i, asn1Data := range rawCerts {\n\t\t\tcert, err := x509.ParseCertificate(asn1Data)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"spiffe: verify function could not parse input certificate: %v\", err)\n\t\t\t}\n\t\t\trawCertList[i] = cert\n\t\t}\n\t\tif len(rawCertList) == 0 {\n\t\t\treturn fmt.Errorf(\"spiffe: verify function has no valid input certificates\")\n\t\t}\n\t\tleafCert := rawCertList[0]\n\t\troots, err := spiffe.GetRootsFromSPIFFEBundleMap(spiffeBundleMap, leafCert)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\topts := x509.VerifyOptions{\n\t\t\tRoots:         roots,\n\t\t\tCurrentTime:   time.Now(),\n\t\t\tIntermediates: x509.NewCertPool(),\n\t\t}\n","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/bootstrap/tlscreds/bundle.go#L148-L184","documentation":"During SPIFFE-based mTLS verification (bundle.go:160-166), the server's raw certificate bytes are parsed with x509.ParseCertificate. If a raw cert blob cannot be parsed as an X.509 certificate (corrupt, malformed, or non-ASN.1 data), this error fires inside the VerifyPeerCertificate callback. The underlying parse error is included.","triggerScenarios":"A server presents a certificate whose DER encoding is malformed, or the raw cert slice contains data that is not a certificate at all. This occurs at TLS handshake time when InsecureSkipVerify is set and the custom SPIFFE verifier is invoked.","commonSituations":"The xDS management server is misconfigured and presenting a corrupt or placeholder certificate; a TLS-terminating proxy in the path alters the certificate chain; an intermediate box injects unexpected bytes; the SPIFFE trust bundle map is enabled (GRPC_XDS_SPIFFE_ENABLED) and the server is not actually SPIFFE-aware.","solutions":["Verify the xDS management server presents a valid X.509 certificate chain using openssl s_client against its endpoint.","If a TLS-terminating proxy is in the path, ensure it forwards the real server certificate rather than a placeholder.","Confirm SPIFFE verification is actually intended for this deployment; if not, disable the SPIFFE trust bundle map.","Inspect the underlying parse error to determine whether the bytes are truncated or a non-cert payload."],"exampleFix":"# diagnose the presented certificate:\n#   openssl s_client -connect xds-server:443 -showcerts\n# if corrupt, fix the server cert; if SPIFFE is not intended,\n# remove spiffe_trust_bundle_map_file from the bootstrap","handlingStrategy":"try-catch","validationCode":"// Before connecting, verify the server presents parseable certs.\nfunc probeServerCert(addr string) error {\n    conf := &tls.Config{InsecureSkipVerify: true}\n    conn, err := tls.Dial(\"tcp\", addr, conf)\n    if err != nil { return err }\n    defer conn.Close()\n    if len(conn.ConnectionState().PeerCertificates) == 0 {\n        return errors.New(\"server presented no certificates\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// The SPIFFE verify error surfaces during ClientHandshake; surface it.\nif err := creds.ClientHandshake(ctx, authority, conn); err != nil {\n    if strings.Contains(err.Error(), \"spiffe: verify function could not parse\") {\n        // server cert is corrupt/malformed; flag to ops\n    }\n    return err\n}","preventionTips":["Pre-flight the xDS server's certificate with openssl s_client.","Ensure no intermediary mangles the certificate bytes.","Confirm SPIFFE verification is actually intended for the target deployment."],"tags":["xds","tls","spiffe","mtls","certificate","grpc"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}