grpc/grpc-go · error

input cert has %v URIs but should have 1

Error message

input cert has %v URIs but should have 1

What it means

Returned by idFromCert when the leaf certificate's URI SAN list has a length other than exactly one. SPIFFE X.509 SVID spec mandates a single URI SAN carrying the SPIFFE ID; zero URIs (a non-SPIFFE cert) or more than one (ambiguous identity) both violate the spec and are rejected.

Source

Thrown at internal/credentials/spiffe/spiffe.go:100

		return nil, fmt.Errorf("spiffe: no bundle found for peer certificates trust domain %q but verification with a SPIFFE trust map was configured", spiffeID.TrustDomain().Name())
	}
	roots := spiffeBundle.X509Authorities()
	rootPool := x509.NewCertPool()
	for _, root := range roots {
		rootPool.AddCert(root)
	}
	return rootPool, nil
}

// idFromCert parses the SPIFFE ID from the x509.Certificate. If the certificate
// does not have a valid SPIFFE ID, returns an error.
func idFromCert(cert *x509.Certificate) (*spiffeid.ID, error) {
	if cert == nil {
		return nil, fmt.Errorf("input cert is nil")
	}
	// A valid SPIFFE Certificate should have exactly one URI.
	if len(cert.URIs) != 1 {
		return nil, fmt.Errorf("input cert has %v URIs but should have 1", len(cert.URIs))
	}
	id, err := spiffeid.FromURI(cert.URIs[0])
	if err != nil {
		return nil, fmt.Errorf("invalid spiffeid: %v", err)
	}
	return &id, nil
}

View on GitHub (pinned to 03255a9237)

Solutions

1. Re-issue the certificate through SPIRE so it carries exactly one spiffe:// URI SAN.
2. Filter to the correct SVID before verification if your cert store contains multiple certs.
3. Do not add extra URI SANs for metadata — use SPIFFE tracker entries or a separate extension.

func certHasExactlyOneURI(c *x509.Certificate) error {
    if c == nil { return errors.New("nil cert") }
    if len(c.URIs) != 1 {
        return fmt.Errorf("expected 1 URI SAN, got %d", len(c.URIs))
    }
    return nil
}

func hasSingleURISAN(c *x509.Certificate) bool {
    return c != nil && len(c.URIs) == 1
}

When it happens

Trigger: Calling GetRootsFromSPIFFEBundleMap with a cert that has no URI SANs, or a cert into which multiple URIs were stuffed (sometimes done to carry metadata). The check is `if len(cert.URIs) != 1` at spiffe.go:99.

Common situations: A cert minted by a generic CA that adds no URI SAN; an experimental cert that embedded multiple spiffe:// URIs; wrong cert passed to a verification routine that expects an SVID.

Related errors

• spiffe: BundleMapFromBytes() failed to parse bundle for trus
• spiffe: could not get spiffe ID from peer leaf cert but veri
• invalid spiffeid: %v
• xds: received DNS SANs: %v do not match the SNI: %s
• spiffe: verify function could not parse input certificate: %

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/cbc8196dd2698c76. Report an issue: GitHub.