# rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: first record does not look like a TLS handshake"

- **ID:** `go/grpc-unavailable-connection-timeout`
- **Domain:** go
- **Category:** network_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The client is using TLS but the server expects plaintext, or vice versa, causing a handshake failure.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 1.0 | active | — | — |
| 1.1 | active | — | — |

## Workarounds

1. **Match TLS settings between client and server: either both use TLS or both use plaintext.** (95% success)
   ```
   // Server with TLS
creds, err := credentials.NewServerTLSFromFile("server.crt", "server.key")
if err != nil { log.Fatal(err) }
s := grpc.NewServer(grpc.Creds(creds))
// Client with TLS
creds, err := credentials.NewClientTLSFromFile("ca.crt", "x")
if err != nil { log.Fatal(err) }
conn, err := grpc.Dial("localhost:8080", grpc.WithTransportCredentials(creds))
   ```
2. **Use insecure connection for development (not recommended for production).** (90% success)
   ```
   conn, err := grpc.Dial("localhost:8080", grpc.WithInsecure())
   ```

## Dead Ends

- **Ignore TLS configuration and assume automatic negotiation.** — gRPC does not auto-negotiate TLS; explicit configuration is required. (100% fail)
- **Use a self-signed certificate without proper validation.** — The server may reject self-signed certs if it requires a trusted CA. (70% fail)