{"record":{"id":"df35d9f98acc93d3","repo":"apache/cassandra","slug":"unable-to-extract-spiffe-from-the-certificate","errorCode":null,"errorMessage":"Unable to extract Spiffe from the certificate","messagePattern":"Unable to extract Spiffe from the certificate","errorType":"exception","errorClass":"CertificateException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/SpiffeCertificateValidator.java","lineNumber":97,"sourceCode":"    private static String getSANSpiffe(final Certificate[] clientCertificates) throws CertificateException\n    {\n        int URI_TYPE = 6;\n        X509Certificate[] castedCerts = castCertsToX509(clientCertificates);\n        Collection<List<?>> subjectAltNames = castedCerts[0].getSubjectAlternativeNames();\n\n        if (subjectAltNames != null)\n        {\n            for (List<?> item : subjectAltNames)\n            {\n                Integer type = (Integer) item.get(0);\n                String spiffe = (String) item.get(1);\n                if (type == URI_TYPE && spiffe.startsWith(\"spiffe://\"))\n                {  // Spiffe is a URI\n                    return spiffe;\n                }\n            }\n        }\n        throw new CertificateException(\"Unable to extract Spiffe from the certificate\");\n    }\n}\n","sourceCodeStart":79,"sourceCodeEnd":100,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/SpiffeCertificateValidator.java#L79-L100","documentation":"SpiffeCertificateValidator.getSANSpiffe() scans the client certificate's Subject Alternative Names for a URI entry starting with spiffe://. If no such SAN is found, it throws a CertificateException meaning the presented certificate cannot be used to establish a SPIFFE identity for mTLS authentication/authorization.","triggerScenarios":"A client presents a certificate during TLS handshake whose SANs contain no URI type entry with a spiffe:// prefix; identity() then fails to extract the Spiffe ID.","commonSituations":"Certificates issued by an internal CA without SPIFFE URI SANs; misconfigured workload/issuer templates (DNS SANs only); using a server cert that lacks the SPIFFE identity extension.","solutions":["Reissue the client certificate including a URI SAN of the form spiffe://<trust-domain>/<path>.","Fix the cert-issuing template (e.g. SPIRE/openssl config) to add the SPIFFE ID as a uniformResourceIdentifier SAN.","Verify with: openssl x509 -in cert.pem -text | grep -A2 'URI' — a spiffe:// URI must be present.","If SPIFFE validation is not intended, switch the certificate validator configuration to a non-Spiffe validator."],"exampleFix":"// before (openssl extfile without spiffe)\nsubjectAltName = DNS:client.example.com\n// after\nsubjectAltName = DNS:client.example.com,URI:spiffe://example.org/ns/default/sa/client","handlingStrategy":"validation","validationCode":"// Verify before configuring SpiffeCertificateValidator:\nCollection<List<?>> sans = cert.getSubjectAlternativeNames();\nboolean hasSpiffe = sans != null && sans.stream()\n    .anyMatch(s -> s.size() > 1 && s.get(0) == 6 && String.valueOf(s.get(1)).startsWith(\"spiffe://\"));\nif (!hasSpiffe) throw new IllegalStateException(\"Certificate lacks spiffe:// URI SAN\");","typeGuard":"boolean hasSpiffeUriSAN(X509Certificate cert) throws CertificateParsingException {\n    return cert.getSubjectAlternativeNames() != null && cert.getSubjectAlternativeNames().stream()\n        .anyMatch(s -> Integer.valueOf(6).equals(s.get(0))\n            && String.valueOf(s.get(1)).startsWith(\"spiffe://\"));\n}","tryCatchPattern":"try {\n    String id = validator.identity(cert);\n} catch (CertificateException e) {\n    log.error(\"No SPIFFE ID in client certificate SANs; reissue cert with spiffe:// URI SAN\");\n}","preventionTips":["Always issue client certs with a spiffe:// URI SAN.","Check certs with openssl before deployment.","Align cert templates with SPIRE/SPIFFE trust-domain naming."],"tags":["cassandra","mtls","certificates","spiffe","tls"],"backgroundTag":"invalid-certificate","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}