{"record":{"id":"a62132d232164b6f","repo":"spring-projects/spring-boot","slug":"unable-to-get-x-509-certificate-factory","errorCode":null,"errorMessage":"Unable to get X.509 certificate factory","messagePattern":"Unable to get X\\.509 certificate factory","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"buildpack/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/docker/ssl/PemCertificateParser.java","lineNumber":77,"sourceCode":"\t */\n\t@Contract(\"!null -> !null\")\n\tstatic @Nullable List<X509Certificate> parse(@Nullable String text) {\n\t\tif (text == null) {\n\t\t\treturn null;\n\t\t}\n\t\tCertificateFactory factory = getCertificateFactory();\n\t\tList<X509Certificate> certs = new ArrayList<>();\n\t\treadCertificates(text, factory, certs::add);\n\t\tAssert.state(!CollectionUtils.isEmpty(certs), \"Missing certificates or unrecognized format\");\n\t\treturn List.copyOf(certs);\n\t}\n\n\tprivate static CertificateFactory getCertificateFactory() {\n\t\ttry {\n\t\t\treturn CertificateFactory.getInstance(\"X.509\");\n\t\t}\n\t\tcatch (CertificateException ex) {\n\t\t\tthrow new IllegalStateException(\"Unable to get X.509 certificate factory\", ex);\n\t\t}\n\t}\n\n\tprivate static void readCertificates(String text, CertificateFactory factory, Consumer<X509Certificate> consumer) {\n\t\ttry {\n\t\t\tMatcher matcher = PATTERN.matcher(text);\n\t\t\twhile (matcher.find()) {\n\t\t\t\tString encodedText = matcher.group(1);\n\t\t\t\tbyte[] decodedBytes = decodeBase64(encodedText);\n\t\t\t\tByteArrayInputStream inputStream = new ByteArrayInputStream(decodedBytes);\n\t\t\t\twhile (inputStream.available() > 0) {\n\t\t\t\t\tconsumer.accept((X509Certificate) factory.generateCertificate(inputStream));\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tcatch (CertificateException ex) {\n\t\t\tthrow new IllegalStateException(\"Error reading certificate: \" + ex.getMessage(), ex);\n\t\t}","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/spring-projects/spring-boot/blob/270dfe353fb830fd69b823a8a859287ff103854b/buildpack/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/docker/ssl/PemCertificateParser.java#L59-L95","documentation":"PemCertificateParser.getCertificateFactory calls CertificateFactory.getInstance(\"X.509\") and wraps any CertificateException in IllegalStateException. Like SHA-256, the X.509 certificate factory is mandatory in every Java SE implementation, so this only fires on a non-compliant or stripped runtime that does not register the sun.security.x509 provider.","triggerScenarios":"CertificateFactory.getInstance(\"X.509\") throws CertificateException because no provider offers the X.509 factory; caught at line 76.","commonSituations":"A jlink-built runtime that excluded certificate providers; a FIPS-hardened or policy-restricted JVM; a non-standard JVM with an incomplete java.security.","solutions":["Run on a stock OpenJDK distribution where X.509 is always available.","If using jlink, do not exclude the certificate-related providers.","Smoke-test: `CertificateFactory.getInstance(\"X.509\")` in jshell."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Startup smoke-test for the X.509 certificate factory\ntry {\n    CertificateFactory.getInstance(\"X.509\");\n} catch (CertificateException e) {\n    throw new IllegalStateException(\n        \"This JRE does not provide an X.509 certificate factory; use a stock OpenJDK.\", e);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run on a stock OpenJDK; X.509 is mandatory.","When building a custom jlink image, do not exclude certificate providers.","Add a smoke-test for CertificateFactory.getInstance(\"X.509\") to your image build."],"tags":["java","security","certificate","jre","buildpack"],"backgroundTag":null,"analyzedSha":"270dfe353fb830fd69b823a8a859287ff103854b","analyzedAt":"2026-08-11T19:42:06.541Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}