{"record":{"id":"c03ea989571731cd","repo":"apereo/cas","slug":"could-not-decode-provided-certificatefile","errorCode":null,"errorMessage":"Could not decode provided CertificateFile: ","messagePattern":"Could not decode provided CertificateFile: ","errorType":"exception","errorClass":"BeanCreationException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-saml-core-api/src/main/java/org/apereo/cas/support/saml/util/credential/BasicX509CredentialFactoryBean.java","lineNumber":144,"sourceCode":"            }\n            return certs.iterator().next();\n        } catch (final Exception e) {\n            throw new BeanCreationException(\"Could not decode provided Entity Certificate file \"\n                + entityResource.getDescription(), e);\n        }\n    }\n\n    private List<X509Certificate> getCertificates() {\n        if (certificateResources == null) {\n            return new ArrayList<>();\n        }\n\n        val certificates = new LazyList<X509Certificate>();\n        for (val r : certificateResources) {\n            try (val is = r.getInputStream()) {\n                certificates.addAll(X509Support.decodeCertificates(is));\n            } catch (final Exception e) {\n                throw new BeanCreationException(\"Could not decode provided CertificateFile: \" + r.getDescription(), e);\n            }\n        }\n        return certificates;\n    }\n\n    private PrivateKey getPrivateKey() {\n        if (null == privateKeyResource) {\n            return null;\n        }\n        try (val is = privateKeyResource.getInputStream()) {\n            return KeySupport.decodePrivateKey(is, getPrivateKeyPassword());\n        } catch (final Exception e) {\n            throw new BeanCreationException(\"Could not decode provided KeyFile \" + privateKeyResource.getDescription(), e);\n        }\n    }\n\n    @Override\n    public boolean isSingleton() {","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-core-api/src/main/java/org/apereo/cas/support/saml/util/credential/BasicX509CredentialFactoryBean.java#L126-L162","documentation":"getCertificates() iterates the configured certificateResources and decodes each into X509 certificates for the entity certificate chain. If any resource cannot be read or decoded as a certificate, bean creation is aborted with BeanCreationException('Could not decode provided CertificateFile: <resource>', cause). The failing resource is named in the message and the underlying exception kept as cause.","triggerScenarios":"A resource in certificateResources returns an InputStream that throws on read, or X509Support.decodeCertificates(is) throws for that stream (empty/corrupt/non-certificate content) while building the chain in getCertificates().","commonSituations":"One entry in a multi-file chain list points at a nonexistent or renamed file; an intermediate CA file is empty or truncated; a private key or CRL file accidentally listed among the certificates; wrong permissions on one file in a directory of chain certs.","solutions":["Identify the failing file from the message (r.getDescription()) and confirm it exists and is readable.","Validate it with openssl x509 -in <file> -text -noout; remove or replace files that are not certificates.","Re-export/re-download the intermediate/root CA certificate if it is truncated or corrupt.","Remove non-certificate files (keys, CRLs) from the certificates list — CRLs belong in the CRL configuration."],"exampleFix":"# before: certificates list contains a corrupt backup file\n# cas.authn.saml.idp.credential.certificates=intermediate.crt,root.crt.bak\n# after\ncas.authn.saml.idp.credential.certificates=file:/etc/cas/chain/intermediate.pem,file:/etc/cas/chain/root.pem","handlingStrategy":"validation","validationCode":"// validate every chain resource before configuring the bean\nfor (var r : certificateResources) {\n    try (var is = r.getInputStream()) {\n        if (X509Support.decodeCertificates(is).isEmpty()) {\n            throw new IllegalStateException(\"No certificate decoded from \" + r.getDescription());\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    credentialFactory.getObject();\n} catch (BeanCreationException e) {\n    if (e.getMessage().startsWith(\"Could not decode provided CertificateFile:\")) {\n        // message names the offending resource; remove/fix that file and retry\n        logger.error(\"Bad certificate chain entry: {}\", e.getMessage(), e.getCause());\n    }\n    throw e;\n}","preventionTips":["Validate each file in the chain with openssl x509 before adding it to the configuration.","Keep only certificates in the chain list — no keys, CRLs, or backup files.","Avoid editor backups (.crt.bak, ~ files) living in the certificate directory where copy-paste can pick them up.","Check readability for each listed file after secret provisioning/mounting."],"tags":["spring","saml","x509","certificate-chain","file-read"],"backgroundTag":"file-read-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}