alibaba/canal · error · UnsupportedOperationException

Unsupported ssl mode: {}

Error message

Unsupported ssl mode: {}

What it means

Thrown by BioSocketChannelPool.openSsl when the configured SslMode is not one of REQUIRED, PREFERRED, VERIFY_CA, or VERIFY_IDENTITY. The switch has no case for DISABLED (or any future/custom mode), so reaching openSsl with such a mode is a programming/config contradiction: you asked to open an SSL socket with a non-SSL mode.

Source

Thrown at driver/src/main/java/com/alibaba/otter/canal/parse/driver/mysql/socket/BioSocketChannelPool.java:50

    private static final Logger logger = LoggerFactory.getLogger(BioSocketChannelPool.class);

    public static BioSocketChannel open(SocketAddress address) throws Exception {
        Socket socket = createSocket(address);
        return new BioSocketChannel(socket);
    }

    public static BioSocketChannel openSsl(Socket socket, SslInfo sslInfo) throws Exception {
        SslMode sslMode = sslInfo.getSslMode();
        switch (sslMode) {
            case REQUIRED:
            case PREFERRED:
            case VERIFY_CA:
            case VERIFY_IDENTITY:
                SSLSocket sslSocket = createSslSocket(socket, sslInfo);
                return new BioSocketChannel(sslSocket);
            default:
                throw new UnsupportedOperationException("Unsupported ssl mode: " + sslMode);
        }
    }

    private static Socket createSocket(SocketAddress address) throws IOException {
        Socket socket;
        socket = new Socket();
        socket.setSoTimeout(BioSocketChannel.SO_TIMEOUT);
        socket.setTcpNoDelay(true);
        socket.setKeepAlive(true);
        socket.setReuseAddress(true);
        socket.connect(address, BioSocketChannel.DEFAULT_CONNECT_TIMEOUT);
        return socket;
    }

    /**
     * from JDBC driver com.mysql.cj.protocol.ExportControlled#performTlsHandshake
     * com.mysql.cj.protocol.ExportControlled#getSSLContext
     *

View on GitHub (pinned to 87be50e876)

Solutions

1. When sslMode is DISABLED/PREFERRED-off, call the plain open(address) path instead of openSsl.
2. Default SslMode to REQUIRED or PREFERRED when SSL is enabled and validate before dispatching.
3. Ensure sslInfo.getSslMode() is never null before openSsl is called.
4. Upgrade the driver so its SslMode enum matches the configured values.

Example fix

// before
BioSocketChannel ch = BioSocketChannelPool.openSsl(sock, sslInfo); // sslMode=DISABLED

// after
BioSocketChannel ch = (sslInfo == null || sslInfo.getSslMode() == SslMode.DISABLED)
    ? BioSocketChannelPool.open(address)
    : BioSocketChannelPool.openSsl(sock, sslInfo);

SslMode mode = (sslInfo == null) ? null : sslInfo.getSslMode();
if (mode == SslMode.DISABLED || mode == null) {
    channel = BioSocketChannelPool.open(address); // plain
} else {
    channel = BioSocketChannelPool.openSsl(sock, sslInfo);
}

public static boolean supportsSslOpen(SslMode m) {
    return m == SslMode.REQUIRED || m == SslMode.PREFERRED
        || m == SslMode.VERIFY_CA || m == SslMode.VERIFY_IDENTITY;
}

try {
    ch = BioSocketChannelPool.openSsl(sock, sslInfo);
} catch (UnsupportedOperationException e) {
    if (e.getMessage().startsWith("Unsupported ssl mode")) {
        // fix config: set a supported SslMode or use open()
    }
    throw e;
}

When it happens

Trigger: Calling openSsl(socket, sslInfo) while sslInfo.getSslMode() returns DISABLED (or null/unknown). Typically the caller chose the SSL path (openSsl) but the SslInfo says SSL is off, which is inconsistent.

Common situations: Config sets sslMode=DISABLED yet the code path forces openSsl; a default SslInfo whose mode was never set; enum value added in a newer version that this build does not know; logic that picks openSsl without consulting sslMode first.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Server certificate identity check failed. The certificate Co
• connect failure
• Can't verify server certificate because no trust manager is
• Failed to retrieve the Common Name (CN) from the server cert
• canal socketChannel netty not support ssl mode: {}

AI-assisted analysis of alibaba/canal@87be50e876 (2026-08-14). Data as JSON: /api/errors/75648997044cdc6e. Report an issue: GitHub.