quarkusio/quarkus · error · SpiffeConnectionException

SPIFFE ID path contains invalid character '' + c + '':

Error message

SPIFFE ID path contains invalid character '' + c + '': 

What it means

A SPIFFE ID path segment contains a character outside the allowed SPIFFE path character set (validated by isValidPathChar). The SPIFFE standard restricts paths to specific ASCII characters so IDs remain portable and unambiguous across systems. The validator rejects the ID before it is used for workload identity decisions.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java:139

        }
        if (path.endsWith("/")) {
            throw new SpiffeConnectionException("SPIFFE ID path must not have a trailing slash: " + spiffeId);
        }
        String[] segments = path.split("/", -1);
        for (int i = 1; i < segments.length; i++) {
            String segment = segments[i];
            if (segment.isEmpty()) {
                throw new SpiffeConnectionException(
                        "SPIFFE ID path must not contain empty segments: " + spiffeId);
            }
            if (".".equals(segment) || "..".equals(segment)) {
                throw new SpiffeConnectionException(
                        "SPIFFE ID path must not contain dot segments: " + spiffeId);
            }
            for (int j = 0; j < segment.length(); j++) {
                char c = segment.charAt(j);
                if (!isValidPathChar(c)) {
                    throw new SpiffeConnectionException(
                            "SPIFFE ID path contains invalid character '" + c + "': " + spiffeId);
                }
            }
        }
    }

    private static String extractOptionalUriSan(X509Certificate cert) {
        try {
            var sans = cert.getSubjectAlternativeNames();
            if (sans == null) {
                return null;
            }
            for (var san : sans) {
                if (san.size() > 1 && san.get(0) instanceof Integer type && type == URI_SAN_TYPE
                        && san.get(1) != null) {
                    return san.get(1).toString();
                }
            }

View on GitHub (pinned to e1c734241f)

Solutions

1. Regenerate the workload certificate so its SPIFFE ID path uses only valid path characters (letters, digits, and standard path punctuation per the SPIFFE spec).
2. Fix the CA/identity-issuance configuration that produces malformed path segments.
3. Log and inspect the offending SPIFFE ID from the certificate URI SAN to identify the exact invalid character and its source.

Example fix

// before (CA emits encoded path)
//   spiffe://trust/ns/prod%20cluster/sa/app
// after (valid segment characters)
//   spiffe://trust/ns/prod-cluster/sa/app

boolean hasValidSpiffePath(String spiffeId) {
    int idx = spiffeId.indexOf("://");
    if (idx < 0) return false;
    String path = spiffeId.substring(spiffeId.indexOf('/', idx + 3));
    for (String seg : path.split("/")) {
        for (char c : seg.toCharArray()) {
            if (!(Character.isLetterOrDigit(c) || c == '.' || c == '-' || c == '_')) return false;
        }
    }
    return true;
}

try {
    validator.validateSpiffeId(id);
} catch (SpiffeConnectionException e) {
    log.errorf("Invalid SPIFFE ID %s: %s", id, e.getMessage());
}

When it happens

Trigger: Calling SpiffeValidator.validateSpiffeId with a SPIFFE ID (from a URI SAN of a workload certificate) whose path segments contain characters like spaces, unicode, '%', or other non-allowed ASCII characters.

Common situations: A workload certificate issued by a non-compliant SPIFFE CA includes malformed URI SANs; URL-encoded or human-readable paths injected into identity strings; manually constructed spiffe:// IDs containing typos or special characters.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Audiences must not be empty
• X.509-SVID certificate chain is empty
• X.509-SVID proto SPIFFE ID does not match the leaf certifica
• X.509-SVID response from SPIRE agent contains a non-X.509 ce
• SPIFFE ID must not be empty

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/9cea4554d72bf5a1. Report an issue: GitHub.