# rpc 错误：code = Unavailable，desc = 连接错误：desc = "transport：认证握手失败：tls：证书验证失败：x509：证书由未知机构签名"

- **ID:** `go/grpc-tls-handshake-failed`
- **领域:** go
- **类别:** auth_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

gRPC 客户端使用 TLS 连接，但服务端证书链不被客户端的根 CA 池信任。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| google.golang.org/grpc 1.0+ | active | — | — |

## 解决方案

1. **** (95% 成功率)
   ```
   Load the correct CA into the client's root pool:
certPool := x509.NewCertPool()
pem, _ := os.ReadFile("ca.pem")
certPool.AppendCertsFromPEM(pem)
creds := credentials.NewTLS(&tls.Config{RootCAs: certPool})
conn, _ := grpc.NewClient(addr, grpc.WithTransportCredentials(creds))
   ```
2. **** (90% 成功率)
   ```
   For internal/self-signed setups, use mTLS with a shared CA:
creds := credentials.NewTLS(&tls.Config{
    Certificates: []tls.Certificate{clientCert},
    RootCAs:      certPool,
    ServerName:   "api.internal",
})
   ```

## 无效尝试

- **** — Disables all certificate validation, exposing the client to MITM; not acceptable in production. (60% 失败率)
- **** — Certificate trust is deterministic; retries fail identically. (95% 失败率)