{"record":{"id":"8d3d48b27b0f2ece","repo":"grpc/grpc-go","slug":"spiffe-verify-function-has-no-valid-input-certifi","errorCode":null,"errorMessage":"spiffe: verify function has no valid input certificates","messagePattern":"spiffe: verify function has no valid input certificates","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/bootstrap/tlscreds/bundle.go","lineNumber":171,"sourceCode":"\treturn errors.New(\"overriding server name is not supported by xDS client TLS credentials\")\n}\n\nfunc (c *reloadingCreds) ServerHandshake(net.Conn) (net.Conn, credentials.AuthInfo, error) {\n\treturn nil, nil, errors.New(\"server handshake is not supported by xDS client TLS credentials\")\n}\n\nfunc buildSPIFFEVerifyFunc(spiffeBundleMap map[string]*spiffebundle.Bundle) func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {\n\treturn func(rawCerts [][]byte, _ [][]*x509.Certificate) error {\n\t\trawCertList := make([]*x509.Certificate, len(rawCerts))\n\t\tfor i, asn1Data := range rawCerts {\n\t\t\tcert, err := x509.ParseCertificate(asn1Data)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"spiffe: verify function could not parse input certificate: %v\", err)\n\t\t\t}\n\t\t\trawCertList[i] = cert\n\t\t}\n\t\tif len(rawCertList) == 0 {\n\t\t\treturn fmt.Errorf(\"spiffe: verify function has no valid input certificates\")\n\t\t}\n\t\tleafCert := rawCertList[0]\n\t\troots, err := spiffe.GetRootsFromSPIFFEBundleMap(spiffeBundleMap, leafCert)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\topts := x509.VerifyOptions{\n\t\t\tRoots:         roots,\n\t\t\tCurrentTime:   time.Now(),\n\t\t\tIntermediates: x509.NewCertPool(),\n\t\t}\n\n\t\tfor _, cert := range rawCertList[1:] {\n\t\t\topts.Intermediates.AddCert(cert)\n\t\t}\n\t\t// The verified chain is (surprisingly) unused.\n\t\tif _, err = rawCertList[0].Verify(opts); err != nil {","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/bootstrap/tlscreds/bundle.go#L153-L189","documentation":"After parsing all raw cert blobs, the SPIFFE verify callback checks that at least one certificate was provided (bundle.go:170-171). If the rawCerts slice is empty — meaning the server sent no certificates during the handshake — verification cannot proceed and this error is returned.","triggerScenarios":"The server completed the TLS handshake but provided zero certificates. The verify callback receives an empty rawCerts slice, so rawCertList ends up empty.","commonSituations":"The xDS server is misconfigured to not send a certificate; a load balancer or TLS offloader in front of the server strips the certificate; an anonymized/TLS-PSK setup that does not use certificates; SPIFFE verification enabled against a non-SPIFFE server.","solutions":["Ensure the xDS management server is configured to present a server certificate.","Remove any TLS-terminating intermediary that strips certificates, or configure it to forward the origin cert.","If SPIFFE is not required, remove spiffe_trust_bundle_map_file from the bootstrap so standard RootCA verification is used instead."],"exampleFix":"# verify the server presents a certificate:\n#   openssl s_client -connect xds-server:443\n# should show 'Server certificate' and the chain;\n# if absent, reconfigure the server's TLS cert","handlingStrategy":"try-catch","validationCode":"// Confirm the server sends at least one certificate.\nfunc ensureServerSendsCert(addr string) error {\n    conf := &tls.Config{InsecureSkipVerify: true}\n    conn, err := tls.Dial(\"tcp\", addr, conf)\n    if err != nil { return err }\n    defer conn.Close()\n    if len(conn.ConnectionState().PeerCertificates) == 0 {\n        return errors.New(\"server sends no certificate\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := creds.ClientHandshake(ctx, authority, conn); err != nil {\n    if strings.Contains(err.Error(), \"no valid input certificates\") {\n        // server misconfigured: not presenting a cert; escalate\n    }\n    return err\n}","preventionTips":["Verify the xDS server is configured to present a server certificate.","Remove any TLS offloader that strips the certificate from the chain.","Disable SPIFFE verification if not needed for the deployment."],"tags":["xds","tls","spiffe","mtls","certificate","grpc"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}