What causes "Thumprint of the leaf chain certificate is invalid" in quarkusio/quarkus?

Import the current leaf certificate of the token issuer into the truststore (keytool -importcert) and restart.

quarkusio/quarkus · error · UnresolvableKeyException

Thumprint of the leaf chain certificate is invalid

Error message

Thumprint of the leaf chain certificate is invalid

What it means

When neither a leaf certificate CN is configured nor custom TokenCertificateValidators are registered, the resolver falls back to checking that the thumbprint of the leaf (first) certificate in the token's x5c chain is present in the truststore. If not, the leaf itself is untrusted and UnresolvableKeyException is thrown.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CertChainPublicKeyResolver.java:98

                }
            }

            // Finally, check the leaf certificate if required
            if (expectedLeafCertificateName.isPresent()) {
                // Compare the leaf certificate common name against the configured value
                String leafCertificateName = HttpSecurityUtils.getCommonName(chain.get(0).getSubjectX500Principal());
                if (!expectedLeafCertificateName.get().equals(leafCertificateName)) {
                    LOG.errorf("Wrong leaf certificate common name: %s", leafCertificateName);
                    throw new UnresolvableKeyException("Wrong leaf certificate common name");
                }
            } else if (certificateValidators.isEmpty()) {
                // No custom validators are registered and no leaf certificate CN is configured
                // Check that the truststore contains a leaf certificate thumbprint
                LOG.debug("Checking a thumbprint of the leaf chain certificate");
                String thumbprint = TrustStoreUtils.calculateThumprint(chain.get(0));
                if (!thumbprints.contains(thumbprint)) {
                    LOG.error("Thumprint of the leaf chain certificate is invalid");
                    throw new UnresolvableKeyException("Thumprint of the leaf chain certificate is invalid");
                }
            }

            return chain.get(0).getPublicKey();
        } catch (UnresolvableKeyException ex) {
            throw ex;
        } catch (Exception ex) {
            throw new UnresolvableKeyException("Invalid certificate chain", ex);
        }
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

Import the current leaf certificate of the token issuer into the truststore (keytool -importcert) and restart.
Or import the root CA only and configure quarkus.oidc.certificate-chain.leaf-certificate-name so leaf verification goes by CN instead of thumbprint.
Or register a TokenCertificateValidator bean to perform custom leaf validation.
Re-export tokens so they carry the certificate chain matching the truststore contents.

Example fix

keytool -importcert -alias issuer-leaf -file issuer-leaf.crt -keystore truststore.p12 -storetype PKCS12

Defensive patterns

Strategy: validation

Validate before calling

Set<String> trusted = TrustStoreUtils.getTrustedCertificateThumbprints(trustStoreFile, password, alias, fileType);
String leafTp = TrustStoreUtils.calculateThumprint(chain.get(0));
if (!trusted.contains(leafTp)) {
    log.warn("Leaf certificate thumbprint not in truststore; import leaf cert or configure leaf-certificate-name / a validator");
}

Try / catch

try {
    return jwtVerify(token);
} catch (UnresolvableKeyException e) {
    if ("Thumprint of the leaf chain certificate is invalid".equals(e.getMessage())) {
        log.error("Import the issuer's current leaf certificate into the truststore");
    }
    throw e;
}

Prevention

Import both the leaf and root certificates of the issuer into the truststore.
After issuer certificate rotation, re-import the new leaf before old tokens expire.
Automate truststore regeneration from the issuer's JWKS/x5c in deployment pipelines.

When it happens

Trigger: resolveKey() runs with expectedLeafCertificateName empty and certificateValidators empty, and TrustStoreUtils.calculateThumprint(chain.get(0)) is not in the set of thumbprints from the configured truststore.

Common situations: Issuer rotated its leaf/signing certificate but only the root was imported; truststore contains only the CA certificate while tokens embed a specific leaf certificate; tenant is receiving tokens signed by a sibling issuer's leaf.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/e897abdc091a5d1f. Report an issue: GitHub.