What causes "Failed to encode certificate to PEM" in quarkusio/quarkus?

Check for custom java.security providers (Security.getProviders()) that override X.509 parsing and remove/fix them.

quarkusio/quarkus · error · IllegalStateException

Failed to encode certificate to PEM

Error message

Failed to encode certificate to PEM

What it means

After successfully parsing certificates from the SPIRE Workload API response, the library converts each X509Certificate to PEM for downstream consumers via cert.getEncoded(). If the certificate provider refuses to DER-encode a certificate (CertificateEncodingException), an IllegalStateException is thrown. This is rare and indicates an internal certificate object inconsistency rather than a configuration problem.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:367

                                    + description + ": " + cert.getClass().getName());
                }
            }
            return result;
        } catch (Exception e) {
            throw new SpiffeConnectionException(
                    "X.509-SVID response from SPIRE agent contains an invalid " + description, e);
        }
    }

    private static List<String> certsToPem(List<X509Certificate> certs) {
        try {
            List<String> result = new ArrayList<>(certs.size());
            for (X509Certificate cert : certs) {
                result.add(toPem("CERTIFICATE", cert.getEncoded()));
            }
            return unmodifiableList(result);
        } catch (CertificateEncodingException e) {
            throw new IllegalStateException("Failed to encode certificate to PEM", e);
        }
    }

    private static String toPem(String type, byte[] der) {
        return "-----BEGIN " + type + "-----\n"
                + PEM_ENCODER.encodeToString(der)
                + "\n-----END " + type + "-----\n";
    }

    private record WorkloadCertificateDocumentImpl(String subject, WorkloadCertificateChainImpl certificateChain,
            WorkloadTrustBundleImpl trustBundle) implements WorkloadCertificateDocument {
    }

    private record WorkloadCertificateChainImpl(List<X509Certificate> chain,
            PrivateKey privateKey) implements WorkloadCertificateChain {

        @Override
        public List<String> chainPem() {

View on GitHub (pinned to e1c734241f)

Solutions

Check for custom java.security providers (Security.getProviders()) that override X.509 parsing and remove/fix them.
Restart the SPIRE agent and retry — a transient corrupted response usually re-parses cleanly.
Catch IllegalStateException and surface it as an application startup failure with the cause logged.
Report to the extension maintainers if reproducible with the standard SunX509 provider.

Example fix

// before
String pem = SpiffeClientHolder.get().getWorkloadCertificatesPem().get(0);
// after
try {
    String pem = SpiffeClientHolder.get().getWorkloadCertificatesPem().get(0);
} catch (IllegalStateException e) {
    throw new RuntimeException("Certificate PEM encoding failed: " + e.getCause(), e);
}

Defensive patterns

Strategy: try-catch

Try / catch

try {
    List<String> pem = SpiffeClientHolder.get().getTrustBundlePem();
} catch (IllegalStateException e) {
    log.errorf(e.getCause(), "Certificate could not be DER-encoded");
    throw new IllegalStateException("PEM conversion failed; check security providers", e);
}

Prevention

Avoid registering custom X.509 JCA providers in the application
Retry once on transient corruption from the agent
Report persistent occurrences with the wrapped cause to maintainers
Keep on a standard JDK (e.g. Temurin) to avoid provider quirks

When it happens

Trigger: certsToPem invoked by getWorkloadCertificates()/getTrustBundle() PEM conversions when X509Certificate.getEncoded() raises CertificateEncodingException (e.g., a malformed certificate implementation from a non-default security provider).

Common situations: A custom JCA security provider registered on the JVM that parses certificates into non-standard implementations; corrupted agent responses that partially parse but cannot re-encode; exotic JDK/provider combinations.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/36619565e00e5f0b. Report an issue: GitHub.