GRPC_TLS_CERT_EXPIRED grpc auth_error ai_generated true

UNAVAILABLE: grpc: TLS handshake failed: certificate has expired

ID: grpc/tls-certificate-expiration

Also available as: JSON · Markdown · 中文
96%Fix Rate
92%Confidence
1Evidence
2024-08-12First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
gRPC v1.48.x active — — —
gRPC v1.58.x active — — —
gRPC v1.64.x active — — —

Root Cause

The TLS certificate used by the gRPC server (or client in mutual TLS) has passed its expiry date, causing the handshake to fail.

generic

中文

gRPC 服务器（或双向 TLS 中的客户端）使用的 TLS 证书已过有效期，导致握手失败。

Official Documentation

https://grpc.io/docs/guides/auth/#tls

Workarounds

  1. 96% success Renew the TLS certificate: generate a new certificate with `openssl req -x509 -newkey rsa:4096 -keyout server_key.pem -out server_cert.pem -days 365 -nodes`, then restart the gRPC server with the new files. 
    Renew the TLS certificate: generate a new certificate with `openssl req -x509 -newkey rsa:4096 -keyout server_key.pem -out server_cert.pem -days 365 -nodes`, then restart the gRPC server with the new files.
  2. 90% success If using Let's Encrypt, run `certbot renew` to automatically renew certificates, then reload the gRPC server (e.g., `kill -HUP <pid>` or restart the process). 
    If using Let's Encrypt, run `certbot renew` to automatically renew certificates, then reload the gRPC server (e.g., `kill -HUP <pid>` or restart the process).
  3. 60% success As a temporary emergency fix, set the system clock back to within the certificate's validity period (not recommended for production), then restart the server. 
    As a temporary emergency fix, set the system clock back to within the certificate's validity period (not recommended for production), then restart the server.

中文步骤

  1. 续期 TLS 证书：使用 `openssl req -x509 -newkey rsa:4096 -keyout server_key.pem -out server_cert.pem -days 365 -nodes` 生成新证书，然后重启 gRPC 服务器。
  2. 如果使用 Let's Encrypt，运行 `certbot renew` 自动续期证书，然后重新加载 gRPC 服务器（如 `kill -HUP <pid>` 或重启进程）。
  3. 作为临时紧急修复，将系统时钟调回证书有效期范围内（不推荐用于生产），然后重启服务器。

Dead Ends

Common approaches that don't work:

  1. 80% fail

    This bypasses hostname verification but not certificate expiration; the handshake still fails because the certificate itself is invalid.

  2. 50% fail

    SSL session caching affects performance, not certificate validation; expiration is checked during full handshake.

  3. 90% fail

    The expired certificate remains the same; restarting does not fix the expiration date.