quarkusio/quarkus · error · SpiffeConnectionException

Leaf certificate must not have 'cRLSign' as key usage

Error message

Leaf certificate must not have 'cRLSign' as key usage

What it means

When validating an X.509 SVID chain, Quarkus SPIFFE client requires that a leaf (end-entity) SVID certificate not have the cRLSign key usage bit set. cRLSign is reserved for certificates that sign certificate revocation lists; a leaf carrying it violates the X.509-SVID profile and could enable revocation-list forgery, so the validator rejects the chain with a SpiffeConnectionException.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java:36

    }

    static String validateLeaf(X509Certificate leaf) throws SpiffeConnectionException {
        if (leaf.getBasicConstraints() != -1) {
            throw new SpiffeConnectionException("Leaf certificate must not have CA flag set to true");
        }

        boolean[] keyUsage = leaf.getKeyUsage();
        if (keyUsage == null) {
            throw new SpiffeConnectionException("Leaf certificate is missing the key usage extension");
        }
        if (keyUsage.length < 1 || !keyUsage[0]) {
            throw new SpiffeConnectionException("Leaf certificate must have 'digitalSignature' as key usage");
        }
        if (keyUsage.length > 5 && keyUsage[5]) {
            throw new SpiffeConnectionException("Leaf certificate must not have 'keyCertSign' as key usage");
        }
        if (keyUsage.length > 6 && keyUsage[6]) {
            throw new SpiffeConnectionException("Leaf certificate must not have 'cRLSign' as key usage");
        }

        return extractAndValidateUriSan(leaf);
    }

    // X.509-SVID 3.2 SHOULD: signing cert SHOULD itself be an SVID (not enforced — upstream CA may not be SPIFFE-aware)
    // X.509-SVID 3.2 SHOULD: signing cert SHOULD reside in the trust domain of leaf SVIDs it issues (not enforced — cross-domain signing is allowed)
    static void validateIntermediate(X509Certificate cert) throws SpiffeConnectionException {
        if (cert.getBasicConstraints() < 0) {
            throw new SpiffeConnectionException(
                    "Signing certificate must have CA flag set to true: " + cert.getSubjectX500Principal());
        }
        boolean[] keyUsage = cert.getKeyUsage();
        if (keyUsage == null || keyUsage.length <= 5 || !keyUsage[5]) {
            throw new SpiffeConnectionException(
                    "Signing certificate must have 'keyCertSign' as key usage: " + cert.getSubjectX500Principal());
        }
        // X.509-SVID 3.2 MUST: if signing cert has a SPIFFE ID, it must not have a path component

View on GitHub (pinned to e1c734241f)

Solutions

  1. Reissue the leaf SVID with a KeyUsage extension limited to digitalSignature (no cRLSign, no keyCertSign).
  2. Fix the issuing CA / cert template so leaf certificates omit cRLSign and keyCertSign.
  3. If you cannot fix the CA, use a SPIFFE-compliant workload API source (e.g. spire-agent) to obtain compliant SVIDs.

Example fix

// before (openssl config for leaf)
keyUsage = digitalSignature, keyCertSign, cRLSign
// after
keyUsage = digitalSignature
Defensive patterns

Strategy: validation

Validate before calling

boolean[] ku = cert.getKeyUsage();
if (ku != null && ku.length > 6 && ku[6]) {
    throw new IllegalArgumentException("Leaf cert must not have cRLSign key usage");
}

Try / catch

try {
    connection.establish();
} catch (SpiffeConnectionException e) {
    if (e.getMessage().contains("cRLSign")) {
        log.error("Leaf SVID has invalid key usage; reissue certificate", e);
    }
    throw e;
}

Prevention

When it happens

Trigger: Calling the workload API / SPIFFE connection validation where the first certificate of the presented chain has keyUsage[6] (cRLSign) = true, e.g. a workload cert whose KeyUsage extension includes digitalSignature plus cRLSign.

Common situations: The certificate authority that issued the workload cert used an over-broad KeyUsage template (copying CA defaults), a misconfigured internal PKI that issues leaf certs with full key usage bits, or a non-SPIFFE-compliant CA minting SVIDs.

Understand the failure class

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/87afed0529ba8a2f. Report an issue: GitHub.