quarkusio/quarkus · error · SpiffeConnectionException

X.509-SVID response from SPIRE agent contains an invalid pri

Error message

X.509-SVID response from SPIRE agent contains an invalid private key

What it means

The client attempted to reconstruct a PrivateKey from the SVID's PKCS8 key bytes using the leaf certificate's public key algorithm, and KeyFactory.generatePrivate threw. The key bytes are not a valid PKCS8 encoding for that algorithm, so no usable key material can be produced.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:324

        X509Certificate leaf = certChain.get(0);
        String sanSpiffeId = SpiffeValidator.validateLeaf(leaf);
        if (!protoSpiffeId.equals(sanSpiffeId)) {
            throw new SpiffeConnectionException(
                    "X.509-SVID proto SPIFFE ID does not match the leaf certificate URI SAN; proto: "
                            + protoSpiffeId + ", SAN: " + sanSpiffeId);
        }
        for (int i = 1; i < certChain.size(); i++) {
            SpiffeValidator.validateIntermediate(certChain.get(i));
        }

        String keyAlgorithm = leaf.getPublicKey().getAlgorithm();
        PrivateKey privateKey;
        try {
            privateKey = KeyFactory.getInstance(keyAlgorithm)
                    .generatePrivate(new PKCS8EncodedKeySpec(svid.getX509SvidKey().toByteArray()));
        } catch (Exception e) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent contains an invalid private key", e);
        }

        List<X509Certificate> trustBundle = parseCertificates(svid.getBundle().toByteArray(), "trust bundle");

        var keyMaterial = new WorkloadCertificateChainImpl(unmodifiableList(certChain), privateKey);
        var trustMaterial = new WorkloadTrustBundleImpl(unmodifiableList(trustBundle));
        return new WorkloadCertificateDocumentImpl(protoSpiffeId, keyMaterial, trustMaterial);
    }

    private static List<X509Certificate> parseCertificates(byte[] derBytes, String description)
            throws SpiffeConnectionException {
        if (derBytes.length == 0) {
            throw new SpiffeConnectionException("X.509-SVID response contains empty " + description);
        }
        try {
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            Collection<?> certs = cf.generateCertificates(new ByteArrayInputStream(derBytes));
            List<X509Certificate> result = new ArrayList<>(certs.size());

View on GitHub (pinned to e1c734241f)

Solutions

Check the leaf cert algorithm (openssl x509 -noout -text) and ensure your JDK supports it (Ed25519 needs JDK 15+).
Upgrade SPIRE agent so keys are delivered in PKCS8 form.
Enable an additional security provider (e.g. BouncyCastle) if the algorithm needs one.
Restart the agent / re-request the SVID to rule out corrupted bytes.

Example fix

// before: JDK 11 cannot parse Ed25519 keys
PrivateKey pk = KeyFactory.getInstance("Ed25519").generatePrivate(spec);
// after: use a runtime/provider that supports it (JDK 15+) or BouncyCastle
Security.addProvider(new BouncyCastleProvider());

Defensive patterns

Strategy: try-catch

Validate before calling

// pre-check JDK support for the cert's key algorithm:
String alg = leaf.getPublicKey().getAlgorithm();
boolean ok = java.security.Security.getAlgorithms("KeyFactory").contains(alg);

Try / catch

try {
    doc = client.getWorkloadCertificate();
} catch (SpiffeConnectionException e) {
    if (e.getMessage().contains("invalid private key")) {
        // check JVM/provider support (e.g. Ed25519 needs JDK15+ or BouncyCastle)
        throw new IllegalStateException("JDK cannot parse SVID key: " + e.getMessage(), e);
    } else throw e;
}

Prevention

Use JDK 15+ (or add BouncyCastle) if SPIRE issues Ed25519 keys
Keep SPIRE agent versions current (PKCS8 key delivery)
Avoid custom key formats in SPIRE server key configuration
Test SVID parsing in CI with the same JDK as production

When it happens

Trigger: getWorkloadCertificate when KeyFactory.getInstance(leaf.getPublicKey().getAlgorithm()).generatePrivate(new PKCS8EncodedKeySpec(...)) throws (InvalidKeySpecException etc.).

Common situations: Non-PKCS8 key format (SEC1/RSA raw) delivered by an old agent; key algorithm not supported by the JDK provider (e.g. exotic EC curves); corrupted key bytes; JVM lacking a provider for the algorithm (e.g. Ed25519 on old JDKs).

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/5513ceb5735f6ff9. Report an issue: GitHub.