{"record":{"id":"ecf297e92a1123af","repo":"grpc/grpc-java","slug":"kid-parameter-must-not-be-set-certificate-loadi","errorCode":null,"errorMessage":"'kid' parameter must not be set. Certificate loading for trust domain '%s' failed.","messagePattern":"'kid' parameter must not be set\\. Certificate loading for trust domain '(.+?)' failed\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/io/grpc/internal/SpiffeUtil.java","lineNumber":217,"sourceCode":"    @SuppressWarnings(\"unchecked\")\n    Map<String, ?> root = (Map<String, ?>)jsonObject;\n    Map<String, ?> trustDomainsNode = JsonUtil.getObject(root, \"trust_domains\");\n    checkNotNull(trustDomainsNode, \"Mandatory trust_domains element is missing\");\n    checkArgument(trustDomainsNode.size() > 0, \"Mandatory trust_domains element is missing\");\n    return trustDomainsNode;\n  }\n\n  private static void checkJwkEntry(Map<String, ?> jwkNode, String trustDomainName) {\n    String kty = JsonUtil.getString(jwkNode, \"kty\");\n    if (kty == null || !KTY_PARAMETER_VALUES.contains(kty)) {\n      throw new IllegalArgumentException(\n          String.format(\n              \"'kty' parameter must be one of %s but '%s' \"\n                  + \"found. Certificate loading for trust domain '%s' failed.\",\n              KTY_PARAMETER_VALUES, kty, trustDomainName));\n    }\n    if (jwkNode.containsKey(\"kid\")) {\n      throw new IllegalArgumentException(String.format(\"'kid' parameter must not be set. \"\n              + \"Certificate loading for trust domain '%s' failed.\", trustDomainName));\n    }\n    String use = JsonUtil.getString(jwkNode, \"use\");\n    if (use == null || !use.equals(USE_PARAMETER_VALUE)) {\n      throw new IllegalArgumentException(String.format(\"'use' parameter must be '%s' but '%s' \"\n              + \"found. Certificate loading for trust domain '%s' failed.\", USE_PARAMETER_VALUE,\n          use, trustDomainName));\n    }\n  }\n\n  private static List<X509Certificate> extractCert(List<Map<String, ?>> keysNode,\n      String trustDomainName) {\n    List<X509Certificate> result = new ArrayList<>();\n    for (Map<String, ?> keyNode : keysNode) {\n      checkJwkEntry(keyNode, trustDomainName);\n      List<String> rawCerts = JsonUtil.getListOfStrings(keyNode, \"x5c\");\n      if (rawCerts == null || rawCerts.isEmpty()) {\n        continue;","sourceCodeStart":199,"sourceCodeEnd":235,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/core/src/main/java/io/grpc/internal/SpiffeUtil.java#L199-L235","documentation":"Per the SPIFFE X.509 bundle spec, JWK entries must not carry a 'kid' (key ID) parameter, since bundle keys are identified by their SPIFFE ID and x5c chain. SpiffeUtil.checkJwkEntry rejects any JWK containing 'kid' with an IllegalArgumentException naming the trust domain.","triggerScenarios":"Loading a trust bundle whose keys include a \"kid\" field — commonly keys copied from a generic OIDC/OAuth JWKS endpoint where kid is standard — via extractCert during bundle loading.","commonSituations":"Reusing JWKS from an identity provider's /.well-known/jwks.json as a SPIFFE trust bundle; SPIFFE-compliant bundles produced by some tooling that adds kid by default.","solutions":["Remove the \"kid\" field from each JWK in the trust bundle file","Obtain a spec-compliant bundle from your SPIRE agent instead of converting an IdP JWKS","Validate bundle keys against the SPIFFE X.509 bundle format (kty, use=x509-svid, x5c; no kid)"],"exampleFix":"// before\n{\"kty\":\"RSA\",\"use\":\"x509-svid\",\"kid\":\"key-1\",\"x5c\":[\"...\"]}\n// after\n{\"kty\":\"RSA\",\"use\":\"x509-svid\",\"x5c\":[\"...\"]}","handlingStrategy":"validation","validationCode":"// Strip/verify no kid fields before loading\nfor (Map<String, ?> key : keys) {\n  if (key.containsKey(\"kid\")) {\n    throw new IllegalStateException(\"JWK must not contain 'kid' (SPIFFE X.509 bundle spec)\");\n  }\n}","typeGuard":"boolean kidFree(Map<String, ?> jwk) {\n  return !jwk.containsKey(\"kid\");\n}","tryCatchPattern":"try {\n  certs = SpiffeUtil.loadTrustBundleFromFile(bundlePath);\n} catch (IllegalArgumentException e) {\n  log.error(\"Trust bundle JWK has disallowed 'kid': \" + e.getMessage());\n  throw new TrustBundleLoadException(e);\n}","preventionTips":["Don't reuse OIDC/OAuth JWKS files as SPIFFE X.509 trust bundles","Validate bundles against the SPIFFE X.509 bundle spec in CI","Use spire-agent bundle output, which omits kid"],"tags":["grpc","spiffe","jwk","trust-bundle","spec-violation"],"backgroundTag":"invalid-config-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}