Spring / Spring CredHub Interview questions
How do you troubleshoot a certificate_unknown error with mutual TLS?
A certificate_unknown error during the mTLS handshake almost always means the app's container isn't presenting a certificate CredHub trusts, so the fix is to check the pieces that make that certificate available rather than anything in Spring CredHub's own configuration.
Start with the buildpack: on Cloud Foundry, mTLS identity depends on the Java buildpack's container security provider being enabled, which is what injects the platform-issued certificate into the app's keystore and truststore at staging time. If that provider isn't active, the app has no certificate to present at all.
If mTLS genuinely isn't viable for the deployment, the practical workaround is to switch to OAuth2 client-credentials authentication instead, double-checking the client ID, secret, and token URI properties, since a partially-configured OAuth2 setup can produce similar-looking connection failures.
More Related questions...
