{"record":{"id":"f621e0b314f0d008","repo":"apereo/cas","slug":"no-certificates-provided","errorCode":null,"errorMessage":"No Certificates provided","messagePattern":"No Certificates provided","errorType":"exception","errorClass":"BeanCreationException","httpStatus":null,"severity":"critical","filePath":"support/cas-server-support-saml-core-api/src/main/java/org/apereo/cas/support/saml/util/credential/BasicX509CredentialFactoryBean.java","lineNumber":70,"sourceCode":"     * Names for the key represented by the credential.\n     */\n    private List<String> keyNames;\n\n    /**\n     * Identifier for the owner of the credential.\n     */\n    private String entityID;\n\n    /**\n     * The privateKey Password (if any).\n     */\n    private char[] privateKeyPassword;\n\n    @Override\n    public BasicX509Credential getObject() throws Exception {\n        val certificates = getCertificates();\n        if (certificates.isEmpty()) {\n            throw new BeanCreationException(\"No Certificates provided\");\n        }\n\n        var entityCertificate = getEntityCertificate();\n        if (null == entityCertificate) {\n            entityCertificate = certificates.getFirst();\n        }\n\n        val privateKey = getPrivateKey();\n        var credential = (BasicX509Credential) null;\n        if (null == privateKey) {\n            credential = new BasicX509Credential(entityCertificate);\n        } else {\n            credential = new BasicX509Credential(entityCertificate, privateKey);\n\n            if (!KeySupport.matchKeyPair(entityCertificate.getPublicKey(), privateKey)) {\n                throw new BeanCreationException(\"Public and private keys do not match\");\n            }\n        }","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-core-api/src/main/java/org/apereo/cas/support/saml/util/credential/BasicX509CredentialFactoryBean.java#L52-L88","documentation":"BasicX509CredentialFactoryBean.getObject throws BeanCreationException because the factory bean was constructed without any certificates configured. It builds a BasicX509Credential (for SAML signing/encryption) and requires at least one certificate; an empty certificate list makes the bean impossible to create.","triggerScenarios":"Spring bean definition of BasicX509CredentialFactoryBean with no certificates/certificate list property set; the configured keystore resource is empty or failed to load yielding zero certificates; property placeholders resolving to nothing so the certificate collection stays empty.","commonSituations":"SAML metadata/signing config referencing a keystore path that does not exist or is unreadable at runtime; typo in the property feeding certificates so it resolves to empty; provisioning step that installs the certificate was skipped in the deployment environment.","solutions":["Set the certificates (and entity certificate) property on the BasicX509CredentialFactoryBean definition, or the cas.* SAML signing certificate configuration that populates it.","Verify the keystore/certificate file exists and is readable by the CAS process in the target environment.","Check for unresolved property placeholders (e.g. ${cas.saml...}) in the bean configuration — unresolved values may leave the list empty.","Re-run certificate provisioning/import steps so the certificate resource contains at least one entry."],"exampleFix":"// before\n@Bean\npublic BasicX509CredentialFactoryBean credential() { return new BasicX509CredentialFactoryBean(); }\n// after\n@Bean\npublic BasicX509CredentialFactoryBean credential() {\n    var fb = new BasicX509CredentialFactoryBean();\n    fb.setCertificates(List.of(new ClassPathResource(\"saml-signing.crt\")));\n    fb.setPrivateKey(new ClassPathResource(\"saml-signing.key\"));\n    return fb;\n}","handlingStrategy":"validation","validationCode":"// Before constructing the factory bean, verify the certificate resource is present and non-empty\nResource cert = new FileSystemResource(keystorePath);\nif (!cert.exists() || cert.contentLength() == 0) {\n    throw new IllegalStateException(\"SAML certificate resource missing or empty: \" + keystorePath);\n}","typeGuard":null,"tryCatchPattern":"try { BasicX509Credential credential = factoryBean.getObject(); }\ncatch (BeanCreationException e) {\n    if (e.getMessage().contains(\"No Certificates provided\")) {\n        logger.error(\"SAML certificate configuration is empty; check certificate/keystore settings\");\n    }\n    throw e;\n}","preventionTips":["Always set at least one certificate (ideally an explicit entity certificate) on the factory bean.","Validate certificate file existence/readability in startup checks or CI before CAS boots.","Check that property placeholders feeding the certificate list resolve to real values.","Include certificate provisioning in deployment playbooks so no environment starts without it."],"tags":["saml","x509","spring-bean","certificate"],"backgroundTag":"missing-required-config-field","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}