go auth_error ai_generated true

rpc 错误：code = Unavailable desc = 连接错误："传输层：认证握手失败：tls: 无法验证证书：x509: 证书由未知机构签名"

rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate signed by unknown authority"

ID: go/grpc-tls-handshake-failure

其他格式: JSON · Markdown 中文 · English
80%修复率
90%置信度
0证据数
2024-08-11首次发现

版本兼容性

版本状态引入弃用备注
1.50+ active — — —

根因分析

客户端的根 CA 池不包含签发服务器证书的 CA。常见于自签名证书、内部 CA，或缺少 grpc.WithTransportCredentials。

English

The client's root CA pool does not contain the CA that signed the server certificate. Common with self-signed certs, internal CAs, or missing grpc.WithTransportCredentials.

generic

解决方案

  1. 93% 成功率 
    b, _ := os.ReadFile("ca.pem")
cp := x509.NewCertPool()
cp.AppendCertsFromPEM(b)
creds := credentials.NewTLS(&tls.Config{RootCAs: cp, ServerName: "myservice.internal"})
conn, err := grpc.Dial(addr, grpc.WithTransportCredentials(creds))
  2. 85% 成功率 
    creds := credentials.NewTLS(&tls.Config{})
// or explicitly:
// tls.Config{RootCAs: nil} uses the host's system pool

无效尝试

常见但无效的做法:

  1. 90% 失败

    Disables certificate validation entirely, exposing the connection to MITM. Not acceptable in production.

  2. 85% 失败

    Mismatches the server's TLS listener; the handshake fails with a different error (record layer failure).