{"record":{"id":"941fbfce07d1225b","repo":"quarkusio/quarkus","slug":"x-509-svid-certificate-chain-is-empty","errorCode":null,"errorMessage":"X.509-SVID certificate chain is empty","messagePattern":"X\\.509-SVID certificate chain is empty","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":304,"sourceCode":"            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent contains no SVIDs\");\n        }\n        X509SVID svid = svids.get(0);\n\n        String protoSpiffeId = svid.getSpiffeId();\n        SpiffeValidator.validateSpiffeId(protoSpiffeId);\n        if (svid.getX509Svid().isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent has empty certificate chain\");\n        }\n        if (svid.getX509SvidKey().isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent has empty private key\");\n        }\n        if (svid.getBundle().isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent has empty trust bundle\");\n        }\n\n        List<X509Certificate> certChain = parseCertificates(svid.getX509Svid().toByteArray(), \"certificate chain\");\n        if (certChain.isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID certificate chain is empty\");\n        }\n\n        X509Certificate leaf = certChain.get(0);\n        String sanSpiffeId = SpiffeValidator.validateLeaf(leaf);\n        if (!protoSpiffeId.equals(sanSpiffeId)) {\n            throw new SpiffeConnectionException(\n                    \"X.509-SVID proto SPIFFE ID does not match the leaf certificate URI SAN; proto: \"\n                            + protoSpiffeId + \", SAN: \" + sanSpiffeId);\n        }\n        for (int i = 1; i < certChain.size(); i++) {\n            SpiffeValidator.validateIntermediate(certChain.get(i));\n        }\n\n        String keyAlgorithm = leaf.getPublicKey().getAlgorithm();\n        PrivateKey privateKey;\n        try {\n            privateKey = KeyFactory.getInstance(keyAlgorithm)\n                    .generatePrivate(new PKCS8EncodedKeySpec(svid.getX509SvidKey().toByteArray()));","sourceCodeStart":286,"sourceCodeEnd":322,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L286-L322","documentation":"After parsing the DER bytes into X.509 certificates, the resulting certificate chain list was empty even though the raw bytes were non-empty. This guard ensures the client never builds key material with zero certificates (no leaf to use as identity).","triggerScenarios":"getWorkloadCertificate via toWorkloadCertificate when parseCertificates returns an empty list for the certificate chain bytes.","commonSituations":"Agent sent garbage/zero-padded bytes in x509_svid; encoding mismatch (PEM bytes where DER is expected); corrupted protobuf payload.","solutions":["Restart the SPIRE agent; corrupt agent state is the usual cause.","Verify agent version compatibility with the server and Workload API.","Re-attest the workload (delete pod/agent entry cache) and re-request the SVID.","Report persistent corruption to SPIRE maintainers; inspect raw bytes for validity."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    doc = client.getWorkloadCertificate();\n} catch (SpiffeConnectionException e) {\n    if (e.getMessage().equals(\"X.509-SVID certificate chain is empty\")) {\n        doc = retryWithBackoff(client::getWorkloadCertificate);\n    } else throw e;\n}","preventionTips":["Restart the agent if payloads are corrupted","Validate SPIRE server/agent compatibility","Re-attest the workload by recycling the pod","Report persistent corrupt payloads to SPIRE support"],"tags":["spiffe","x509","certificate","parsing"],"backgroundTag":"certificate-parse-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}