grpc/grpc-go · error

invalid spiffeid: %v

Error message

invalid spiffeid: %v

What it means

Returned by idFromCert when the single URI SAN of the certificate cannot be parsed as a SPIFFE ID by spiffeid.FromURI. This validates the SPIFFE ID grammar: the URI scheme must be 'spiffe', the host (trust domain) must be non-empty and valid, and the path must conform to the SPIFFE path rules. The underlying go-spiffe error is wrapped.

Source

Thrown at internal/credentials/spiffe/spiffe.go:104

	for _, root := range roots {
		rootPool.AddCert(root)
	}
	return rootPool, nil
}

// idFromCert parses the SPIFFE ID from the x509.Certificate. If the certificate
// does not have a valid SPIFFE ID, returns an error.
func idFromCert(cert *x509.Certificate) (*spiffeid.ID, error) {
	if cert == nil {
		return nil, fmt.Errorf("input cert is nil")
	}
	// A valid SPIFFE Certificate should have exactly one URI.
	if len(cert.URIs) != 1 {
		return nil, fmt.Errorf("input cert has %v URIs but should have 1", len(cert.URIs))
	}
	id, err := spiffeid.FromURI(cert.URIs[0])
	if err != nil {
		return nil, fmt.Errorf("invalid spiffeid: %v", err)
	}
	return &id, nil
}

View on GitHub (pinned to 03255a9237)

Solutions

1. Inspect the URI SAN and confirm it is a well-formed spiffe:// URI with a non-empty trust domain and a conformant path.
2. Re-issue the SVID through SPIRE with the correct trust domain and workload path.
3. Upgrade or pin go-spiffe consistently across minting and verifying components so the ID grammar checks agree.

func certHasValidSpiffeID(c *x509.Certificate) error {
    if len(c.URIs) != 1 { return fmt.Errorf("expected 1 URI, got %d", len(c.URIs)) }
    if _, err := spiffeid.FromURI(c.URIs[0]); err != nil {
        return fmt.Errorf("invalid spiffe ID: %w", err)
    }
    return nil
}

func isValidSpiffeCert(c *x509.Certificate) bool {
    if c == nil || len(c.URIs) != 1 { return false }
    _, err := spiffeid.FromURI(c.URIs[0])
    return err == nil
}

When it happens

Trigger: A URI SAN like "https://example/workload", "spiffe://", "spiffe:///path" (empty trust domain), or a path with forbidden characters. spiffeid.FromURI enforces the grammar from the SPIFFE ID spec.

Common situations: Cert minted with a generic URI SAN; SPIRE trust domain left blank during signing; path validation rules tightened by a go-spiffe version bump that rejects previously-accepted IDs.

Related errors

• spiffe: BundleMapFromBytes() invalid trust domain %q found w
• spiffe: BundleMapFromBytes() failed to parse bundle for trus
• input cert has %v URIs but should have 1
• spiffe: verify function could not parse input certificate: %
• spiffe: verify function has no valid input certificates

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/0a185a16e4718688. Report an issue: GitHub.