What causes "canal socketChannel netty not support ssl mode: {}" in alibaba/canal?

Remove canal.socketChannel=netty (or set canal.socketChannel=bio) — SSL is only supported on the BIO socket channel. This is the supported path for SSL connections.

alibaba/canal · error · UnsupportedOperationException

canal socketChannel netty not support ssl mode: {}

Error message

canal socketChannel netty not support ssl mode: {}

What it means

Thrown by SocketChannelPool.connectSsl(SocketChannel, SslInfo) when the chosen socket implementation is 'netty' (canal.socketChannel=netty) and an SslInfo is supplied. The netty SocketChannel implementation in canal has no SSL/TLS support wired in, so connectSsl refuses outright with UnsupportedOperationException naming the requested SslMode. Only the BIO path (BioSocketChannelPool.openSsl) implements SSL.

Source

Thrown at driver/src/main/java/com/alibaba/otter/canal/parse/driver/mysql/socket/SocketChannelPool.java:34

 */
public abstract class SocketChannelPool {

    private static final Logger logger = LoggerFactory.getLogger(SocketChannelPool.class);

    public static SocketChannel open(SocketAddress address) throws Exception {
        String type = chooseSocketChannel();
        if ("netty".equalsIgnoreCase(type)) {
            return NettySocketChannelPool.open(address);
        } else {
            return BioSocketChannelPool.open(address);
        }
    }

    public static SocketChannel connectSsl(SocketChannel channel, SslInfo sslInfo) throws IOException {
        SslMode sslMode = sslInfo.getSslMode();
        String type = chooseSocketChannel();
        if ("netty".equalsIgnoreCase(type)) {
            throw new UnsupportedOperationException("canal socketChannel netty not support ssl mode: " + sslMode);
        } else {
            SocketAddress remoteSocketAddress = channel.getRemoteSocketAddress();
            try {
                return BioSocketChannelPool.openSsl(((BioSocketChannel) channel).getSocket(), sslInfo);
            } catch (Exception e) {
                if (sslMode == SslMode.PREFERRED) {
                    // still use non ssl channel
                    logger.info("{} still use non SSL channel due to SSL connect failed.", remoteSocketAddress, e);
                    return channel;
                }
                IOException ioe;
                if (e instanceof IOException) {
                    ioe = (IOException) e;
                } else {
                    ioe = new IOException(e);
                }
                throw ioe;
            }

View on GitHub (pinned to 87be50e876)

Solutions

Remove canal.socketChannel=netty (or set canal.socketChannel=bio) — SSL is only supported on the BIO socket channel. This is the supported path for SSL connections.
If you must keep netty, drop the SSL requirement: clear canal.instance.db.sslMode / SslInfo so connectSsl is never invoked.
Verify which selector is active via System property or env var canal.socketChannel — env wins over -D in chooseSocketChannel().
On RDS/Aurora/CloudSQL that mandate TLS, stay on bio and set sslMode=REQUIRED (or VERIFY_CA / VERIFY_IDENTITY as needed).

Example fix

# before — conflicting config
canal.socketChannel = netty
canal.instance.db.sslMode = REQUIRED

# after — SSL supported only on bio
canal.socketChannel = bio
canal.instance.db.sslMode = REQUIRED

Defensive patterns

Strategy: validation

Validate before calling

String socketChannel = System.getenv("canal.socketChannel");
if (StringUtils.isEmpty(socketChannel)) {
    socketChannel = System.getProperty("canal.socketChannel");
}
boolean sslRequested = /* the SslInfo / canal.instance.db.sslMode is non-DISABLED */;
if ("netty".equalsIgnoreCase(socketChannel) && sslRequested) {
    throw new IllegalStateException(
        "SSL requires canal.socketChannel=bio; netty has no SSL support.");
}

Try / catch

try {
    SocketChannel ch = SocketChannelPool.connectSsl(existing, sslInfo);
} catch (UnsupportedOperationException e) {
    if (e.getMessage() != null && e.getMessage().contains("netty not support ssl")) {
        log.error("SSL + netty is unsupported; switching to bio");
        // reconfigure canal.socketChannel=bio and reconnect, or drop SSL
    }
    throw e;
}

Prevention

Never combine canal.socketChannel=netty with an SSL requirement — only BIO supports SSL.
When enforcing TLS to RDS/Aurora/CloudSQL, keep canal.socketChannel=bio (or unset).
Validate the SSL/mode pair at config-load time rather than at first connection.
Remember env var canal.socketChannel takes precedence over the -D system property.

When it happens

Trigger: Configuring canal.instance.db.sslMode (or otherwise supplying SslInfo) while canal.socketChannel=netty, then triggering a connection that calls SocketChannelPool.connectSsl. Any non-null SslInfo with the netty selector hits this throw regardless of the SslMode value.

Common situations: Enforcing TLS to MySQL (RDS/Aurora/CloudSQL requiring SSL) and having previously switched to netty for performance; upgrading canal and enabling SSL for compliance without realising the netty implementation lacks it; copying an instance config that sets both canal.socketChannel=netty and canal.instance.db.sslMode=REQUIRED.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of alibaba/canal@87be50e876 (2026-08-14). Data as JSON: /api/errors/59076a866c2ae0ce. Report an issue: GitHub.