go auth_error ai_generated true

rpc 错误：code = Unavailable，desc = 连接错误：desc = "transport：认证握手失败：tls：证书验证失败：x509：证书由未知机构签名"

rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate signed by unknown authority"

ID: go/grpc-tls-handshake-failed

其他格式: JSON · Markdown 中文 · English
80%修复率
89%置信度
0证据数
2024-01-15首次发现

版本兼容性

版本状态引入弃用备注
google.golang.org/grpc 1.0+ active — — —

根因分析

gRPC 客户端使用 TLS 连接，但服务端证书链不被客户端的根 CA 池信任。

English

The gRPC client connected with TLS but the server's certificate chain is not trusted by the client's root CA pool.

generic

解决方案

  1. 95% 成功率 
    Load the correct CA into the client's root pool:
certPool := x509.NewCertPool()
pem, _ := os.ReadFile("ca.pem")
certPool.AppendCertsFromPEM(pem)
creds := credentials.NewTLS(&tls.Config{RootCAs: certPool})
conn, _ := grpc.NewClient(addr, grpc.WithTransportCredentials(creds))
  2. 90% 成功率 
    For internal/self-signed setups, use mTLS with a shared CA:
creds := credentials.NewTLS(&tls.Config{
    Certificates: []tls.Certificate{clientCert},
    RootCAs:      certPool,
    ServerName:   "api.internal",
})

无效尝试

常见但无效的做法:

  1. 60% 失败

    Disables all certificate validation, exposing the client to MITM; not acceptable in production.

  2. 95% 失败

    Certificate trust is deterministic; retries fail identically.