go auth_error ai_generated true

rpc 错误：code = Unavailable desc = 连接错误：传输：认证握手失败：tls: 首条记录不像 TLS 握手

rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: first record does not look like a TLS handshake"

ID: go/grpc-permission-denied-tls

其他格式: JSON · Markdown 中文 · English
80%修复率
87%置信度
0证据数
2024-07-03首次发现

版本兼容性

版本状态引入弃用备注
google.golang.org/grpc 1.x active — — —

根因分析

客户端尝试对明文 gRPC 服务端使用 TLS，或反之。通常发生在客户端使用 credentials.NewTLS 但服务端未启用 TLS 凭据启动时。

English

The client tried to use TLS against a plaintext gRPC server, or vice versa. Typically happens when the client uses credentials.NewTLS but the server was started without TLS credentials.

generic

解决方案

  1. 92% 成功率 
    // server
creds, _ := credentials.NewServerTLSFromFile("server.crt", "server.key")
s := grpc.NewServer(grpc.Creds(creds))
// client
creds, _ := credentials.NewClientTLSFromFile("ca.crt", "")
conn, _ := grpc.Dial(addr, grpc.WithTransportCredentials(creds))
  2. 85% 成功率 
    if os.Getenv("ENV") == "local" {
    conn, _ = grpc.Dial(addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
} else {
    conn, _ = grpc.Dial(addr, grpc.WithTransportCredentials(creds))
}

无效尝试

常见但无效的做法:

  1. 95% 失败

    The handshake fails before certificate verification; the server is not speaking TLS at all.

  2. 90% 失败

    The handshake fails immediately due to protocol mismatch, not latency.