go auth_error ai_generated true

rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: client didn't provide a certificate"

ID: go/grpc-missing-client-certificate

Also available as: JSON · Markdown · 中文
80%Fix Rate
88%Confidence
0Evidence
2024-02-10First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
1.x active — — —

Root Cause

The gRPC server requires mutual TLS (mTLS) but the client did not present a client certificate during the TLS handshake.

generic

中文

gRPC 服务器要求双向 TLS（mTLS），但客户端在 TLS 握手期间未提供客户端证书。

Workarounds

  1. 90% success 
    cert, _ := tls.LoadX509KeyPair("client.crt", "client.key"); creds := credentials.NewTLS(&tls.Config{Certificates: []tls.Certificate{cert}}); conn, _ := grpc.Dial(address, grpc.WithTransportCredentials(creds))
  2. 85% success 
    Use a proper CA-signed client certificate and configure the server's CA pool.

Dead Ends

Common approaches that don't work:

  1. 60% fail

    This weakens security and may not be possible in production environments.

  2. 70% fail

    Clients typically need a separate client certificate signed by a CA; using the server cert will still fail.