go auth_error ai_generated true

rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate signed by unknown authority"

ID: go/grpc-tls-handshake-failed

Also available as: JSON · Markdown · 中文
80%Fix Rate
89%Confidence
0Evidence
2024-01-15First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
google.golang.org/grpc 1.0+ active — — —

Root Cause

The gRPC client connected with TLS but the server's certificate chain is not trusted by the client's root CA pool.

generic

中文

gRPC 客户端使用 TLS 连接，但服务端证书链不被客户端的根 CA 池信任。

Workarounds

  1. 95% success 
    Load the correct CA into the client's root pool:
certPool := x509.NewCertPool()
pem, _ := os.ReadFile("ca.pem")
certPool.AppendCertsFromPEM(pem)
creds := credentials.NewTLS(&tls.Config{RootCAs: certPool})
conn, _ := grpc.NewClient(addr, grpc.WithTransportCredentials(creds))
  2. 90% success 
    For internal/self-signed setups, use mTLS with a shared CA:
creds := credentials.NewTLS(&tls.Config{
    Certificates: []tls.Certificate{clientCert},
    RootCAs:      certPool,
    ServerName:   "api.internal",
})

Dead Ends

Common approaches that don't work:

  1. 60% fail

    Disables all certificate validation, exposing the client to MITM; not acceptable in production.

  2. 95% fail

    Certificate trust is deterministic; retries fail identically.