quarkusio/quarkus · error · SpiffeConnectionException

X.509-SVID response from SPIRE agent contains no SVIDs

Error message

X.509-SVID response from SPIRE agent contains no SVIDs

What it means

The Workload API X.509SVIDResponse returned by the SPIRE agent contained an empty list of SVIDs. The client requires at least one X.509-SVID to build the workload certificate document, so it throws instead of returning an empty/invalid result. This indicates the agent did not deliver any identity for this workload.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:286

        if (exp == null) {
            throw new SpiffeConnectionException("JWT-SVID from SPIRE agent is missing the required 'exp' claim");
        }
        Instant expiry = Instant.ofEpochSecond(exp);
        if (expiry.isBefore(Instant.now())) {
            throw new SpiffeConnectionException("JWT-SVID from SPIRE agent is already expired");
        }

        record WorkloadJsonWebTokenImpl(String token, String subject, Set<String> audience,
                Instant expiry) implements WorkloadJsonWebToken {
        }
        return new WorkloadJsonWebTokenImpl(token, sub, Set.copyOf(audience), expiry);
    }

    private static WorkloadCertificateDocument toWorkloadCertificate(X509SVIDResponse response)
            throws SpiffeConnectionException {
        List<X509SVID> svids = response.getSvidsList();
        if (svids.isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent contains no SVIDs");
        }
        X509SVID svid = svids.get(0);

        String protoSpiffeId = svid.getSpiffeId();
        SpiffeValidator.validateSpiffeId(protoSpiffeId);
        if (svid.getX509Svid().isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent has empty certificate chain");
        }
        if (svid.getX509SvidKey().isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent has empty private key");
        }
        if (svid.getBundle().isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent has empty trust bundle");
        }

        List<X509Certificate> certChain = parseCertificates(svid.getX509Svid().toByteArray(), "certificate chain");
        if (certChain.isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID certificate chain is empty");

View on GitHub (pinned to e1c734241f)

Solutions

1. Verify a SPIRE registration entry exists for this workload (spire-server entry show) with matching selectors and parent ID.
2. Check quarkus.spiffe.trust-domain/socket configuration and the SPIFFE_WORKLOAD_API endpoint the client connects to.
3. Verify attestation succeeded on the agent (spire-agent log; workload attestation selectors).
4. Recreate the registration entry and confirm the agent syncs it, then retry.

Example fix

// before: workload without entry -> empty SVIDs
// create a registration entry first:
// spire-server entry create -spiffeID spiffe://example.org/ns/prod/sa/app \
//   -parentID spiffe://example.org/spire/agent/node -selector k8s:ns:prod
WorkloadCertificateDocument doc = client.getWorkloadCertificate();

// verify a registration entry exists before starting the app:
// spire-server entry show -spiffeID spiffe://example.org/ns/prod/sa/app
// verify agent socket exists: ls -l /run/spire/agent-sockets/agent.sock

try {
    doc = client.getWorkloadCertificate();
} catch (SpiffeConnectionException e) {
    if (e.getMessage().contains("contains no SVIDs")) {
        throw new IllegalStateException("Workload not registered with SPIRE; create a registration entry", e);
    } else throw e;
}

When it happens

Trigger: Calling getWorkloadCertificate when the agent's X509SVIDs list is empty (response.getSvidsList().isEmpty()).

Common situations: Workload not registered in SPIRE (no registration entry matching its parent ID/selectors); wrong socket path to the Workload API; workload identity expired and agent purged it; SPIRE server unreachable so the agent has no entries to attest.

Related errors

• X.509-SVID response from SPIRE agent has empty certificate c
• X.509-SVID response from SPIRE agent has empty trust bundle
• JWT-SVID from SPIRE agent has no token
• JWT-SVID from SPIRE agent is already expired
• X.509-SVID response from SPIRE agent has empty private key

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/bc1f56954b7abccc. Report an issue: GitHub.