go auth_error ai_generated true

rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate signed by unknown authority"

ID: go/grpc-tls-handshake-failure

Also available as: JSON · Markdown · 中文
80%Fix Rate
90%Confidence
0Evidence
2024-08-11First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
1.50+ active — — —

Root Cause

The client's root CA pool does not contain the CA that signed the server certificate. Common with self-signed certs, internal CAs, or missing grpc.WithTransportCredentials.

generic

中文

客户端的根 CA 池不包含签发服务器证书的 CA。常见于自签名证书、内部 CA，或缺少 grpc.WithTransportCredentials。

Workarounds

  1. 93% success 
    b, _ := os.ReadFile("ca.pem")
cp := x509.NewCertPool()
cp.AppendCertsFromPEM(b)
creds := credentials.NewTLS(&tls.Config{RootCAs: cp, ServerName: "myservice.internal"})
conn, err := grpc.Dial(addr, grpc.WithTransportCredentials(creds))
  2. 85% success 
    creds := credentials.NewTLS(&tls.Config{})
// or explicitly:
// tls.Config{RootCAs: nil} uses the host's system pool

Dead Ends

Common approaches that don't work:

  1. 90% fail

    Disables certificate validation entirely, exposing the connection to MITM. Not acceptable in production.

  2. 85% fail

    Mismatches the server's TLS listener; the handshake fails with a different error (record layer failure).