# rpc 错误：code = Unavailable desc = 连接错误："传输层：认证握手失败：tls: 无法验证证书：x509: 证书由未知机构签名"

- **ID:** `go/grpc-tls-handshake-failure`
- **领域:** go
- **类别:** auth_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

客户端的根 CA 池不包含签发服务器证书的 CA。常见于自签名证书、内部 CA，或缺少 grpc.WithTransportCredentials。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| 1.50+ | active | — | — |

## 解决方案

1. **** (93% 成功率)
   ```
   b, _ := os.ReadFile("ca.pem")
cp := x509.NewCertPool()
cp.AppendCertsFromPEM(b)
creds := credentials.NewTLS(&tls.Config{RootCAs: cp, ServerName: "myservice.internal"})
conn, err := grpc.Dial(addr, grpc.WithTransportCredentials(creds))
   ```
2. **** (85% 成功率)
   ```
   creds := credentials.NewTLS(&tls.Config{})
// or explicitly:
// tls.Config{RootCAs: nil} uses the host's system pool
   ```

## 无效尝试

- **** — Disables certificate validation entirely, exposing the connection to MITM. Not acceptable in production. (90% 失败率)
- **** — Mismatches the server's TLS listener; the handshake fails with a different error (record layer failure). (85% 失败率)