quarkusio/quarkus · error · SpiffeConnectionException

X.509-SVID certificate chain is empty

Error message

X.509-SVID certificate chain is empty

What it means

After parsing the DER bytes into X.509 certificates, the resulting certificate chain list was empty even though the raw bytes were non-empty. This guard ensures the client never builds key material with zero certificates (no leaf to use as identity).

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:304

            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent contains no SVIDs");
        }
        X509SVID svid = svids.get(0);

        String protoSpiffeId = svid.getSpiffeId();
        SpiffeValidator.validateSpiffeId(protoSpiffeId);
        if (svid.getX509Svid().isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent has empty certificate chain");
        }
        if (svid.getX509SvidKey().isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent has empty private key");
        }
        if (svid.getBundle().isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent has empty trust bundle");
        }

        List<X509Certificate> certChain = parseCertificates(svid.getX509Svid().toByteArray(), "certificate chain");
        if (certChain.isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID certificate chain is empty");
        }

        X509Certificate leaf = certChain.get(0);
        String sanSpiffeId = SpiffeValidator.validateLeaf(leaf);
        if (!protoSpiffeId.equals(sanSpiffeId)) {
            throw new SpiffeConnectionException(
                    "X.509-SVID proto SPIFFE ID does not match the leaf certificate URI SAN; proto: "
                            + protoSpiffeId + ", SAN: " + sanSpiffeId);
        }
        for (int i = 1; i < certChain.size(); i++) {
            SpiffeValidator.validateIntermediate(certChain.get(i));
        }

        String keyAlgorithm = leaf.getPublicKey().getAlgorithm();
        PrivateKey privateKey;
        try {
            privateKey = KeyFactory.getInstance(keyAlgorithm)
                    .generatePrivate(new PKCS8EncodedKeySpec(svid.getX509SvidKey().toByteArray()));

View on GitHub (pinned to e1c734241f)

Solutions

1. Restart the SPIRE agent; corrupt agent state is the usual cause.
2. Verify agent version compatibility with the server and Workload API.
3. Re-attest the workload (delete pod/agent entry cache) and re-request the SVID.
4. Report persistent corruption to SPIRE maintainers; inspect raw bytes for validity.

try {
    doc = client.getWorkloadCertificate();
} catch (SpiffeConnectionException e) {
    if (e.getMessage().equals("X.509-SVID certificate chain is empty")) {
        doc = retryWithBackoff(client::getWorkloadCertificate);
    } else throw e;
}

When it happens

Trigger: getWorkloadCertificate via toWorkloadCertificate when parseCertificates returns an empty list for the certificate chain bytes.

Common situations: Agent sent garbage/zero-padded bytes in x509_svid; encoding mismatch (PEM bytes where DER is expected); corrupted protobuf payload.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• X.509-SVID response from SPIRE agent contains a non-X.509 ce
• Failed to extract URI SAN from leaf certificate
• X.509-SVID response contains empty ${description}
• Leaf certificate has no Subject Alternative Names
• Leaf certificate has no URI Subject Alternative Names

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/941fbfce07d1225b. Report an issue: GitHub.