grpc/grpc-go · error
input cert is nil
Error message
input cert is nil
What it means
Raised by idFromCert when the *x509.Certificate argument is nil. This is a programming-error guard: the caller passed a nil leaf cert into SPIFFE ID extraction.
Source
Thrown at internal/credentials/spiffe/spiffe.go:96
// the SPIFFE trust bundle. If the trust domain is not contained in the
// configured trust map, reject the certificate.
spiffeBundle, ok := bundleMap[spiffeID.TrustDomain().Name()]
if !ok {
return nil, fmt.Errorf("spiffe: no bundle found for peer certificates trust domain %q but verification with a SPIFFE trust map was configured", spiffeID.TrustDomain().Name())
}
roots := spiffeBundle.X509Authorities()
rootPool := x509.NewCertPool()
for _, root := range roots {
rootPool.AddCert(root)
}
return rootPool, nil
}
// idFromCert parses the SPIFFE ID from the x509.Certificate. If the certificate
// does not have a valid SPIFFE ID, returns an error.
func idFromCert(cert *x509.Certificate) (*spiffeid.ID, error) {
if cert == nil {
return nil, fmt.Errorf("input cert is nil")
}
// A valid SPIFFE Certificate should have exactly one URI.
if len(cert.URIs) != 1 {
return nil, fmt.Errorf("input cert has %v URIs but should have 1", len(cert.URIs))
}
id, err := spiffeid.FromURI(cert.URIs[0])
if err != nil {
return nil, fmt.Errorf("invalid spiffeid: %v", err)
}
return &id, nil
}
View on GitHub (pinned to 0c51461d27)
Solutions
- Guard for a nil leaf certificate before calling idFromCert or GetRootsFromSPIFFEBundleMap.
- Trace why the leaf is nil: usually an earlier x509.ParseCertificate failure was swallowed or the rawCerts slice was empty.
- Add a unit test asserting the nil-leaf branch returns this exact error.
Example fix
// before
roots, err := spiffe.GetRootsFromSPIFFEBundleMap(m, leaf) // leaf may be nil
// after
if leaf == nil {
return nil, errors.New("no leaf certificate in chain")
}
roots, err := spiffe.GetRootsFromSPIFFEBundleMap(m, leaf) Defensive patterns
Strategy: type-guard
Validate before calling
func safeGetRoots(m map[string]*spiffebundle.Bundle, leaf *x509.Certificate) (*x509.CertPool, error) {
if leaf == nil { return nil, errors.New("no peer leaf certificate") }
return spiffe.GetRootsFromSPIFFEBundleMap(m, leaf)
} Type guard
func nonNilCert(c *x509.Certificate) bool { return c != nil } Try / catch
Always nil-check the leaf in a custom verifier before delegating to SPIFFE helpers; return a descriptive error instead of letting the helper's guard fire.
Prevention
- Never assume the TLS stack hands you a non-nil leaf — verify the rawCerts slice length first.
- Propagate parse errors from x509.ParseCertificate rather than swallowing them.
- Add a test that an empty peer cert chain produces your friendly error.
When it happens
Trigger: Calling idFromCert(nil) directly, or GetRootsFromSPIFFEBundleMap(map, nil) when the verification path handed in a nil leaf because the cert chain was empty or parsing upstream failed silently.
Common situations: A custom verification callback that does not guard the leaf before calling these helpers; a test that constructs the call with an uninitialized cert variable; a bug in chain assembly.
Related errors
- spiffe: BundleMapFromBytes() failed to parse bundle for trus
- spiffe: could not get spiffe ID from peer leaf cert but veri
- input cert has %v URIs but should have 1
- invalid spiffeid: %v
- spiffe: BundleMapFromBytes() no bundles parsed from spiffe b
AI-assisted analysis of grpc/grpc-go@0c51461d27 (2026-08-11).
Data as JSON: /api/errors/01c239066f2ee277.
Report an issue: GitHub.