spring-projects/spring-boot · error · IllegalStateException

Error reading certificate: {}

Error message

Error reading certificate: {}

What it means

Inside PemCertificateParser.readCertificates, after the HEADER/BASE64_TEXT/FOOTER regex matches a block and decodeBase64 decodes it, factory.generateCertificate(inputStream) is called. A CertificateException means the decoded bytes are not a valid DER-encoded X.509 certificate. The wrapping IllegalStateException includes the underlying exception's message.

Source

Thrown at buildpack/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/docker/ssl/PemCertificateParser.java:94

		catch (CertificateException ex) {
			throw new IllegalStateException("Unable to get X.509 certificate factory", ex);
		}
	}

	private static void readCertificates(String text, CertificateFactory factory, Consumer<X509Certificate> consumer) {
		try {
			Matcher matcher = PATTERN.matcher(text);
			while (matcher.find()) {
				String encodedText = matcher.group(1);
				byte[] decodedBytes = decodeBase64(encodedText);
				ByteArrayInputStream inputStream = new ByteArrayInputStream(decodedBytes);
				while (inputStream.available() > 0) {
					consumer.accept((X509Certificate) factory.generateCertificate(inputStream));
				}
			}
		}
		catch (CertificateException ex) {
			throw new IllegalStateException("Error reading certificate: " + ex.getMessage(), ex);
		}
	}

	private static byte[] decodeBase64(String content) {
		byte[] bytes = content.replace("\r", "").replace("\n", "").getBytes();
		return Base64.getDecoder().decode(bytes);
	}

}

View on GitHub (pinned to 270dfe353f)

Solutions

1. Validate the file: `openssl x509 -in cert.pem -noout` (it must parse cleanly).
2. Re-export the certificate as a standard PEM: `openssl x509 -in cert.pem -out cert-clean.pem`.
3. Ensure the full BEGIN CERTIFICATE ... END CERTIFICATE block and its base64 body are intact.

// Validate the PEM cert externally before invoking the build
Process p = new ProcessBuilder("openssl", "x509", "-in", certPath.toString(), "-noout")
        .redirectErrorStream(true).start();
if (p.waitFor() != 0) {
    throw new IllegalArgumentException("Invalid certificate at " + certPath);
}

try {
    PemCertificateParser.parse(text);
} catch (IllegalStateException ex) {
    if (ex.getCause() instanceof CertificateException
            && ex.getMessage().startsWith("Error reading certificate")) {
        // hint: validate / re-export the PEM with openssl
    }
    throw ex;
}

When it happens

Trigger: The regex matched a -----BEGIN ... CERTIFICATE----- block, but the base64 body decoded to bytes that factory.generateCertificate cannot parse: truncated body, corrupted bytes, a non-X.509 object, or an OpenSSL-specific BEGIN TRUSTED CERTIFICATE block.

Common situations: Copy-pasting a cert and dropping the last few base64 lines; line-ending corruption (CRLF/LF mixed); a PGP or S/MIME block that happens to match the regex; an OpenSSL BEGIN TRUSTED CERTIFICATE that the X.509 factory rejects.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Error adding certificates to KeyStore: {}
• Error loading private key file: {}
• Missing private key or unrecognized format
• Error creating KeyStore: {}
• Error decrypting private key

AI-assisted analysis of spring-projects/spring-boot@270dfe353f (2026-08-11). Data as JSON: /api/errors/bb168d5694c30976. Report an issue: GitHub.