{"record":{"id":"e930ffb08c3623f1","repo":"spring-projects/spring-security","slug":"server-error","errorCode":"server_error","errorMessage":"Failed to compute SHA-256 Thumbprint for client X509Certificate.","messagePattern":"Failed to compute SHA-256 Thumbprint for client X509Certificate\\.","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":400,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/DefaultOAuth2TokenCustomizers.java","lineNumber":88,"sourceCode":"\t\tif (OAuth2TokenType.ACCESS_TOKEN.equals(tokenContext.getTokenType())\n\t\t\t\t&& tokenContext.getAuthorizationGrant() != null && tokenContext.getAuthorizationGrant()\n\t\t\t\t\t.getPrincipal() instanceof OAuth2ClientAuthenticationToken clientAuthentication) {\n\n\t\t\tif ((ClientAuthenticationMethod.TLS_CLIENT_AUTH.equals(clientAuthentication.getClientAuthenticationMethod())\n\t\t\t\t\t|| ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH\n\t\t\t\t\t\t.equals(clientAuthentication.getClientAuthenticationMethod()))\n\t\t\t\t\t&& tokenContext.getRegisteredClient().getTokenSettings().isX509CertificateBoundAccessTokens()) {\n\n\t\t\t\tX509Certificate[] clientCertificateChain = (X509Certificate[]) clientAuthentication.getCredentials();\n\t\t\t\ttry {\n\t\t\t\t\tString sha256Thumbprint = computeSHA256Thumbprint(clientCertificateChain[0]);\n\t\t\t\t\tcnfClaims = new HashMap<>();\n\t\t\t\t\tcnfClaims.put(\"x5t#S256\", sha256Thumbprint);\n\t\t\t\t}\n\t\t\t\tcatch (Exception ex) {\n\t\t\t\t\tOAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.SERVER_ERROR,\n\t\t\t\t\t\t\t\"Failed to compute SHA-256 Thumbprint for client X509Certificate.\", null);\n\t\t\t\t\tthrow new OAuth2AuthenticationException(error, ex);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// Add 'cnf' claim for OAuth 2.0 Demonstrating Proof of Possession (DPoP)\n\t\tJwt dPoPProofJwt = tokenContext.get(OAuth2TokenContext.DPOP_PROOF_KEY);\n\t\tif (OAuth2TokenType.ACCESS_TOKEN.equals(tokenContext.getTokenType()) && dPoPProofJwt != null) {\n\t\t\tJWK jwk = null;\n\t\t\t@SuppressWarnings(\"unchecked\")\n\t\t\tMap<String, Object> jwkJson = (Map<String, Object>) dPoPProofJwt.getHeaders().get(\"jwk\");\n\t\t\ttry {\n\t\t\t\tjwk = JWK.parse(jwkJson);\n\t\t\t}\n\t\t\tcatch (Exception ignored) {\n\t\t\t}\n\t\t\tif (jwk == null) {\n\t\t\t\tOAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.INVALID_DPOP_PROOF,\n\t\t\t\t\t\t\"jwk header is missing or invalid.\", null);","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/DefaultOAuth2TokenCustomizers.java#L70-L106","documentation":"For TLS client authentication (tls_client_auth or self_signed_tls_client_auth) with x509-certificate-bound access tokens, the JWT access token customizer computes the RFC 8705 SHA-256 thumbprint (x5t#S256) of the client's X509Certificate to bind the token to it. This RuntimeException fires when the thumbprint computation fails — e.g. the certificate is null/missing from the client authentication, or the certificate encoding cannot be digested — so the token cannot be issued with the required certificate binding.","triggerScenarios":"Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/DefaultOAuth2TokenCustomizers.java:88 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the OAuth2ClientAuthenticationToken carries a valid client X509Certificate for the TLS client authentication method","Verify the certificate is PEM/DER encodable and not corrupted","Check that isX509CertificateBoundAccessTokens is only enabled for registrations that actually use certificate-bound tokens","Confirm the JCA SHA-256 MessageDigest provider is available in the runtime"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}