quarkusio/quarkus · error · SpiffeConnectionException

X.509-SVID response from SPIRE agent contains an invalid ${d

Error message

X.509-SVID response from SPIRE agent contains an invalid ${description}

What it means

When parsing an X.509-SVID response fetched from the local SPIRE agent, the workload API returned data that could not be interpreted as a valid certificate chain or trust bundle for the requested type (leaf chain or trust bundle). The library wraps the underlying parsing/DER-decoding exception in a SpiffeConnectionException describing which part (the 'description' argument) was invalid. This indicates the SPIRE agent returned structurally corrupt or non-X.509 data.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:354

        if (derBytes.length == 0) {
            throw new SpiffeConnectionException("X.509-SVID response contains empty " + description);
        }
        try {
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            Collection<?> certs = cf.generateCertificates(new ByteArrayInputStream(derBytes));
            List<X509Certificate> result = new ArrayList<>(certs.size());
            for (var cert : certs) {
                if (cert instanceof X509Certificate x509) {
                    result.add(x509);
                } else {
                    throw new SpiffeConnectionException(
                            "X.509-SVID response from SPIRE agent contains a non-X.509 certificate in "
                                    + description + ": " + cert.getClass().getName());
                }
            }
            return result;
        } catch (Exception e) {
            throw new SpiffeConnectionException(
                    "X.509-SVID response from SPIRE agent contains an invalid " + description, e);
        }
    }

    private static List<String> certsToPem(List<X509Certificate> certs) {
        try {
            List<String> result = new ArrayList<>(certs.size());
            for (X509Certificate cert : certs) {
                result.add(toPem("CERTIFICATE", cert.getEncoded()));
            }
            return unmodifiableList(result);
        } catch (CertificateEncodingException e) {
            throw new IllegalStateException("Failed to encode certificate to PEM", e);
        }
    }

    private static String toPem(String type, byte[] der) {
        return "-----BEGIN " + type + "-----\n"

View on GitHub (pinned to e1c734241f)

Solutions

Verify you are connecting to a genuine SPIRE agent socket (check quarkus.spiffe.trust-domain, socket path and that spire-agent is running).
Upgrade or restart the SPIRE agent and confirm it serves healthy SVIDs (spire-agent api fetch x509).
Catch SpiffeConnectionException and log the cause (the wrapped exception) to identify the malformed data source.
Ensure no proxy/firewall/antivirus is intercepting the unix or tcp socket connection to the agent.

Example fix

// before
List<X509Certificate> chain = SpiffeClientHolder.get().getWorkloadCertificates();
// after
try {
    List<X509Certificate> chain = SpiffeClientHolder.get().getWorkloadCertificates();
} catch (SpiffeConnectionException e) {
    LOG.errorf(e, "SPIRE agent returned invalid X.509 data; cause=%s", e.getCause());
}

Defensive patterns

Strategy: try-catch

Validate before calling

// verify agent reachability before relying on the client
SocketAddress addr = SpiffeClientHolder.get().getSocket(); // must connect to a real SPIRE agent
// pre-check with spire-agent CLI or HealthCheck if exposed

Try / catch

try {
    List<String> pem = SpiffeClientHolder.get().getWorkloadCertificatesPem();
} catch (SpiffeConnectionException e) {
    log.errorf(e.getCause(), "Invalid X.509 data from SPIRE agent");
    throw new IllegalStateException("SPIRE workload API returned malformed certificates", e);
}

Prevention

Confirm the configured socket address points at a real SPIRE agent
Pin and test a known-good SPIRE agent version
Log e.getCause() — it holds the underlying parse error
Exclude proxies/interceptors from the agent socket path

When it happens

Trigger: Calling X509SvidFetcher.fetchX509Svids or X509BundleFetcher.fetchX509Bundles over the Workload API stream when the agent's protobuf payload decodes to bytes that fail CertificateFactory.generateCertificates, or a decoded entry is not an X509Certificate instance.

Common situations: A broken/incompatible SPIRE agent version emitting unexpected payload contents; a misconfigured socket path connecting to a non-SPIRE service that returns garbage on the stream; corrupted responses due to proxy or socket interception.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/64597d8e9b38e3a0. Report an issue: GitHub.