{"record":{"id":"fbd01d037296d90d","repo":"quarkusio/quarkus","slug":"x-509-svid-response-contains-empty-description","errorCode":null,"errorMessage":"X.509-SVID response contains empty ${description}","messagePattern":"X\\.509-SVID response contains empty (.+?)","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":337,"sourceCode":"        PrivateKey privateKey;\n        try {\n            privateKey = KeyFactory.getInstance(keyAlgorithm)\n                    .generatePrivate(new PKCS8EncodedKeySpec(svid.getX509SvidKey().toByteArray()));\n        } catch (Exception e) {\n            throw new SpiffeConnectionException(\"X.509-SVID response from SPIRE agent contains an invalid private key\", e);\n        }\n\n        List<X509Certificate> trustBundle = parseCertificates(svid.getBundle().toByteArray(), \"trust bundle\");\n\n        var keyMaterial = new WorkloadCertificateChainImpl(unmodifiableList(certChain), privateKey);\n        var trustMaterial = new WorkloadTrustBundleImpl(unmodifiableList(trustBundle));\n        return new WorkloadCertificateDocumentImpl(protoSpiffeId, keyMaterial, trustMaterial);\n    }\n\n    private static List<X509Certificate> parseCertificates(byte[] derBytes, String description)\n            throws SpiffeConnectionException {\n        if (derBytes.length == 0) {\n            throw new SpiffeConnectionException(\"X.509-SVID response contains empty \" + description);\n        }\n        try {\n            CertificateFactory cf = CertificateFactory.getInstance(\"X.509\");\n            Collection<?> certs = cf.generateCertificates(new ByteArrayInputStream(derBytes));\n            List<X509Certificate> result = new ArrayList<>(certs.size());\n            for (var cert : certs) {\n                if (cert instanceof X509Certificate x509) {\n                    result.add(x509);\n                } else {\n                    throw new SpiffeConnectionException(\n                            \"X.509-SVID response from SPIRE agent contains a non-X.509 certificate in \"\n                                    + description + \": \" + cert.getClass().getName());\n                }\n            }\n            return result;\n        } catch (Exception e) {\n            throw new SpiffeConnectionException(\n                    \"X.509-SVID response from SPIRE agent contains an invalid \" + description, e);","sourceCodeStart":319,"sourceCodeEnd":355,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L319-L355","documentation":"parseCertificates was handed a zero-length byte array for the described field (certificate chain or trust bundle). Rather than attempting to parse nothing, the client fails fast with a message identifying which field was empty. It is a precondition check guarding X.509 parsing.","triggerScenarios":"toWorkloadCertificate passing empty byte arrays from svid.getX509Svid().toByteArray() or svid.getBundle().toByteArray() into parseCertificates. In practice the earlier isEmpty() guards (2212/2214) usually catch this first.","commonSituations":"Mostly defensive: same root causes as empty cert chain / trust bundle — agent serving incomplete SVIDs, version mismatch, proxies truncating protobufs.","solutions":["Restart/upgrade the SPIRE agent so the SVID contains all fields.","Verify the client connects to the genuine Workload API socket without an intermediate proxy.","Re-request the workload certificate and compare; persistent emptiness points to agent/server sync issues.","Check SPIRE registration entries and attestation status for the workload."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    doc = client.getWorkloadCertificate();\n} catch (SpiffeConnectionException e) {\n    if (e.getMessage().contains(\"contains empty\")) {\n        doc = retryWithBackoff(client::getWorkloadCertificate);\n    } else throw e;\n}","preventionTips":["Fix upstream causes (empty SVID fields) rather than working around this guard","Keep the agent healthy so fields are always populated","Avoid intermediaries that truncate Workload API responses","Add startup checks verifying complete SVID delivery"],"tags":["spiffe","x509","parsing","empty-input"],"backgroundTag":"certificate-parse-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}