go auth_error ai_generated true

rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: first record does not look like a TLS handshake"

ID: go/grpc-permission-denied-tls

Also available as: JSON · Markdown · 中文
80%Fix Rate
87%Confidence
0Evidence
2024-07-03First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
google.golang.org/grpc 1.x active — — —

Root Cause

The client tried to use TLS against a plaintext gRPC server, or vice versa. Typically happens when the client uses credentials.NewTLS but the server was started without TLS credentials.

generic

中文

客户端尝试对明文 gRPC 服务端使用 TLS，或反之。通常发生在客户端使用 credentials.NewTLS 但服务端未启用 TLS 凭据启动时。

Workarounds

  1. 92% success 
    // server
creds, _ := credentials.NewServerTLSFromFile("server.crt", "server.key")
s := grpc.NewServer(grpc.Creds(creds))
// client
creds, _ := credentials.NewClientTLSFromFile("ca.crt", "")
conn, _ := grpc.Dial(addr, grpc.WithTransportCredentials(creds))
  2. 85% success 
    if os.Getenv("ENV") == "local" {
    conn, _ = grpc.Dial(addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
} else {
    conn, _ = grpc.Dial(addr, grpc.WithTransportCredentials(creds))
}

Dead Ends

Common approaches that don't work:

  1. 95% fail

    The handshake fails before certificate verification; the server is not speaking TLS at all.

  2. 90% fail

    The handshake fails immediately due to protocol mismatch, not latency.