{"record":{"id":"d7857a9349560307","repo":"quarkusio/quarkus","slug":"x-509-svid-response-from-spire-agent-has-empty-pri","errorCode":null,"errorMessage":"X.509-SVID response from SPIRE agent has empty private key","messagePattern":"X\\.509-SVID response from SPIRE agent has empty private key","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":296,"sourceCode":"        }\n        return new WorkloadJsonWebTokenImpl(token, sub, Set.copyOf(audience), expiry);\n    }\n\n    private static WorkloadCertificateDocument toWorkloadCertificate(X509SVIDResponse response)\n            throws SpiffeConnectionException {\n        List<X509SVID> svids = response.getSvidsList();\n        if (svids.isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent contains no SVIDs\");\n        }\n        X509SVID svid = svids.get(0);\n\n        String protoSpiffeId = svid.getSpiffeId();\n        SpiffeValidator.validateSpiffeId(protoSpiffeId);\n        if (svid.getX509Svid().isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent has empty certificate chain\");\n        }\n        if (svid.getX509SvidKey().isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent has empty private key\");\n        }\n        if (svid.getBundle().isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent has empty trust bundle\");\n        }\n\n        List<X509Certificate> certChain = parseCertificates(svid.getX509Svid().toByteArray(), \"certificate chain\");\n        if (certChain.isEmpty()) {\n            throw new SpiffeConnectionException(\"X.509-SVID certificate chain is empty\");\n        }\n\n        X509Certificate leaf = certChain.get(0);\n        String sanSpiffeId = SpiffeValidator.validateLeaf(leaf);\n        if (!protoSpiffeId.equals(sanSpiffeId)) {\n            throw new SpiffeConnectionException(\n                    \"X.509-SVID proto SPIFFE ID does not match the leaf certificate URI SAN; proto: \"\n                            + protoSpiffeId + \", SAN: \" + sanSpiffeId);\n        }\n        for (int i = 1; i < certChain.size(); i++) {","sourceCodeStart":278,"sourceCodeEnd":314,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L278-L314","documentation":"The X.509-SVID contained an empty x509_svid_key field, i.e. no private key bytes accompanied the certificate chain. The client needs the private key to build a KeyPair/key material for mTLS, so an SVID without a key is unusable and rejected.","triggerScenarios":"getWorkloadCertificate when the selected X509SVID's getX509SvidKey() ByteString is empty.","commonSituations":"Incompatible or buggy SPIRE agent build omitting the key; partially overwritten protobuf message; custom Workload API stub or mock returning incomplete SVIDs.","solutions":["Restart/upgrade the SPIRE agent so it serves complete SVIDs (cert + key + bundle).","Confirm no intermediary (sidecar proxy, egress filter) strips protobuf fields.","Re-request the SVID; transient truncation may resolve on retry.","If using a mock/stub Workload API in tests, populate x509_svid_key with a valid PKCS8-encoded key."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    doc = client.getWorkloadCertificate();\n} catch (SpiffeConnectionException e) {\n    if (e.getMessage().contains(\"empty private key\")) {\n        doc = retryWithBackoff(client::getWorkloadCertificate);\n    } else throw e;\n}","preventionTips":["Use a supported, current SPIRE agent release","Never mock the Workload API with incomplete SVIDs in integration tests","Restart the agent if fields are intermittently empty","Pin agent/server versions in your deployment"],"tags":["spiffe","spire","private-key","malformed-response"],"backgroundTag":"malformed-workload-api-response","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}