go auth_error ai_generated true

rpc 错误：代码 = PermissionDenied，描述 = 传输层认证握手失败：tls：首条记录不像 TLS 握手

rpc error: code = PermissionDenied desc = transport: authentication handshake failed: tls: first record does not look like a TLS handshake

ID: go/grpc-permission-denied-tls

其他格式: JSON · Markdown 中文 · English
80%修复率
88%置信度
0证据数
2024-04-11首次发现

版本兼容性

版本状态引入弃用备注
1.50+ active — — —

根因分析

客户端使用了 TLS 凭据但服务端以明文提供服务（或反之）。服务端收到 TLS ClientHello 却期望 HTTP/2 明文。

English

Client used TLS credentials but the server is serving plaintext (or vice versa). The server received a TLS ClientHello but expected HTTP/2 plaintext.

generic

解决方案

  1. 92% 成功率 
    Match client/server transport mode. For plaintext servers:
conn, _ := grpc.NewClient(addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
For TLS servers:
creds := credentials.NewTLS(&tls.Config{RootCAs: pool})
conn, _ := grpc.NewClient(addr, grpc.WithTransportCredentials(creds))
  2. 80% 成功率 
    Inspect the server's actual protocol with openssl/curl before dialing:
openssl s_client -connect host:port -alpn h2 < /dev/null

无效尝试

常见但无效的做法:

  1. 90% 失败

    The error is not about cert validation — the bytes aren't TLS at all; skipping verification doesn't change the wire format.

  2. 85% 失败

    Root CAs only matter after the handshake begins; here the handshake never starts.