# rpc 错误：code = Unavailable desc = 连接错误：传输：认证握手失败：tls: 首条记录不像 TLS 握手

- **ID:** `go/grpc-permission-denied-tls`
- **领域:** go
- **类别:** auth_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

客户端尝试对明文 gRPC 服务端使用 TLS，或反之。通常发生在客户端使用 credentials.NewTLS 但服务端未启用 TLS 凭据启动时。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| google.golang.org/grpc 1.x | active | — | — |

## 解决方案

1. **** (92% 成功率)
   ```
   // server
creds, _ := credentials.NewServerTLSFromFile("server.crt", "server.key")
s := grpc.NewServer(grpc.Creds(creds))
// client
creds, _ := credentials.NewClientTLSFromFile("ca.crt", "")
conn, _ := grpc.Dial(addr, grpc.WithTransportCredentials(creds))
   ```
2. **** (85% 成功率)
   ```
   if os.Getenv("ENV") == "local" {
    conn, _ = grpc.Dial(addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
} else {
    conn, _ = grpc.Dial(addr, grpc.WithTransportCredentials(creds))
}
   ```

## 无效尝试

- **** — The handshake fails before certificate verification; the server is not speaking TLS at all. (95% 失败率)
- **** — The handshake fails immediately due to protocol mismatch, not latency. (90% 失败率)