dapr/dapr · error

issuer chain does not belong to trust anchors: %w

Error message

issuer chain does not belong to trust anchors: %w

What it means

Error "issuer chain does not belong to trust anchors: %w" thrown in dapr/dapr.

Source

Thrown at pkg/sentry/server/ca/validate.go:123

		return nil, errors.New("issuer key does not match issuer certificate")
	}

	// Ensure issuer chain belongs to one of the trust anchors.
	trustAnchorPool := x509.NewCertPool()
	for _, cert := range trustAnchorsX509 {
		trustAnchorPool.AddCert(cert)
	}

	intPool := x509.NewCertPool()
	for _, cert := range issChain[1:] {
		intPool.AddCert(cert)
	}

	if _, err := issChain[0].Verify(x509.VerifyOptions{
		Roots:         trustAnchorPool,
		Intermediates: intPool,
	}); err != nil {
		return nil, fmt.Errorf("issuer chain does not belong to trust anchors: %w", err)
	}

	return &bundle.X509{
		TrustAnchors: trustAnchors,
		IssChainPEM:  issChainPEM,
		IssChain:     issChain,
		IssKeyPEM:    issKeyPEM,
		IssKey:       issKey,
	}, nil
}

// loadJWTSigningKey loads a JWT signing key from PEM format.
func loadJWTSigningKey(keyPEM []byte) (crypto.Signer, error) {
	privateKey, err := pem.DecodePEMPrivateKey(keyPEM)
	if err != nil {
		return nil, fmt.Errorf("failed to decode JWT signing key: %w", err)
	}

View on GitHub (pinned to 74ad417027)

When it happens

Trigger: Thrown at pkg/sentry/server/ca/validate.go:123 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of dapr/dapr@74ad417027 (2026-08-16). Data as JSON: /api/errors/6cbabde920fc725f. Report an issue: GitHub.