quarkusio/quarkus · error · SpiffeConnectionException

X.509-SVID response from SPIRE agent has empty trust bundle

Error message

X.509-SVID response from SPIRE agent has empty trust bundle

What it means

The X.509-SVID's bundle field was empty, so no trust bundle bytes accompanied the SVID. The trust bundle is required to validate peer certificates in the SPIFFE trust domain, so the client rejects the response as incomplete.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:299

    private static WorkloadCertificateDocument toWorkloadCertificate(X509SVIDResponse response)
            throws SpiffeConnectionException {
        List<X509SVID> svids = response.getSvidsList();
        if (svids.isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent contains no SVIDs");
        }
        X509SVID svid = svids.get(0);

        String protoSpiffeId = svid.getSpiffeId();
        SpiffeValidator.validateSpiffeId(protoSpiffeId);
        if (svid.getX509Svid().isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent has empty certificate chain");
        }
        if (svid.getX509SvidKey().isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent has empty private key");
        }
        if (svid.getBundle().isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent has empty trust bundle");
        }

        List<X509Certificate> certChain = parseCertificates(svid.getX509Svid().toByteArray(), "certificate chain");
        if (certChain.isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID certificate chain is empty");
        }

        X509Certificate leaf = certChain.get(0);
        String sanSpiffeId = SpiffeValidator.validateLeaf(leaf);
        if (!protoSpiffeId.equals(sanSpiffeId)) {
            throw new SpiffeConnectionException(
                    "X.509-SVID proto SPIFFE ID does not match the leaf certificate URI SAN; proto: "
                            + protoSpiffeId + ", SAN: " + sanSpiffeId);
        }
        for (int i = 1; i < certChain.size(); i++) {
            SpiffeValidator.validateIntermediate(certChain.get(i));
        }

View on GitHub (pinned to e1c734241f)

Solutions

1. Restart the SPIRE agent to force re-sync of trust bundles from the server.
2. Verify the SPIRE server has the trust bundle for the domain (spire-server bundle show).
3. Update agent/server to matching versions.
4. If federating, ensure the federation relationship and bundle endpoints are configured.

// pre-check bundle availability on the server:
// spire-server bundle show -id spiffe://example.org

try {
    doc = client.getWorkloadCertificate();
} catch (SpiffeConnectionException e) {
    if (e.getMessage().contains("empty trust bundle")) {
        doc = retryWithBackoff(client::getWorkloadCertificate);
    } else throw e;
}

When it happens

Trigger: getWorkloadCertificate when the selected X509SVID's getBundle() ByteString is empty.

Common situations: SPIRE agent with an out-of-sync bundle cache; new trust domain not yet federated; agent/server version mismatch where bundle distribution failed.

Related errors

• X.509-SVID response from SPIRE agent contains no SVIDs
• JWT-SVID from SPIRE agent has no token
• JWT-SVID from SPIRE agent is already expired
• X.509-SVID response from SPIRE agent has empty certificate c
• X.509-SVID response from SPIRE agent has empty private key

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/1a8648071efaa828. Report an issue: GitHub.