{"record":{"id":"05ab35bec63ce0bb","repo":"grpc/grpc-java","slug":"not-enough-information-to-validate-peer-sslengine","errorCode":null,"errorMessage":"Not enough information to validate peer. SSLEngine or Socket required.","messagePattern":"Not enough information to validate peer\\. SSLEngine or Socket required\\.","errorType":"exception","errorClass":"CertificateException","httpStatus":null,"severity":"error","filePath":"util/src/main/java/io/grpc/util/AdvancedTlsX509TrustManager.java","lineNumber":77,"sourceCode":"  private static final int MINIMUM_REFRESH_PERIOD_IN_MINUTES = 1;\n  private static final String NOT_ENOUGH_INFO_MESSAGE =\n      \"Not enough information to validate peer. SSLEngine or Socket required.\";\n  private final Verification verification;\n  private final SslSocketAndEnginePeerVerifier socketAndEnginePeerVerifier;\n\n  // The delegated trust manager used to perform traditional certificate verification.\n  private volatile X509ExtendedTrustManager delegateManager = null;\n\n  private AdvancedTlsX509TrustManager(Verification verification,\n      SslSocketAndEnginePeerVerifier socketAndEnginePeerVerifier) {\n    this.verification = verification;\n    this.socketAndEnginePeerVerifier = socketAndEnginePeerVerifier;\n  }\n\n  @Override\n  public void checkClientTrusted(X509Certificate[] chain, String authType)\n      throws CertificateException {\n    throw new CertificateException(NOT_ENOUGH_INFO_MESSAGE);\n  }\n\n  @Override\n  public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket)\n      throws CertificateException {\n    checkTrusted(chain, authType, null, socket, false);\n  }\n\n  @Override\n  public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine)\n      throws CertificateException {\n    checkTrusted(chain, authType, engine, null, false);\n  }\n\n  @Override\n  public void checkServerTrusted(X509Certificate[] chain,  String authType, SSLEngine engine)\n      throws CertificateException {\n    checkTrusted(chain, authType, engine, null, true);","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/util/src/main/java/io/grpc/util/AdvancedTlsX509TrustManager.java#L59-L95","documentation":"AdvancedTlsX509TrustManager.checkClientTrusted(X509Certificate[], String) intentionally always throws CertificateException: with only the certificate chain and authType there is not enough information to verify the peer, so verification must use the Socket- or SSLEngine-taking overloads or a custom socketAndEnginePeerVerifier.","triggerScenarios":"Using AdvancedTlsX509TrustManager in a context that invokes the two-argument X509TrustManager.checkClientTrusted overload, e.g. default TLS stacks or code that downcasts the manager to X509TrustManager and calls the base method.","commonSituations":"Plugging this manager into libraries that only call the 2-arg methods; missing a custom X509SocketAndEnginePeerVerifier when hostnames/peers are resolved outside Socket/SSLEngine.","solutions":["Use checkClientTrusted(chain, authType, Socket) or (chain, authType, SSLEngine) overloads instead of the 2-arg form","Provide an AdvancedTlsX509TrustManager.ForTesting constructor with a custom socketAndEnginePeerVerifier for non-standard transports","Ensure the TLS provider supports the X509ExtendedTrustManager overloads this manager implements","Switch to a plain X509TrustManager if peer verification must rely solely on chain/authType"],"exampleFix":"// before\ntrustManager.checkClientTrusted(chain, authType); // always throws\n// after\ntrustManager.checkClientTrusted(chain, authType, sslSocket); // verify via socket peer","handlingStrategy":"try-catch","validationCode":null,"typeGuard":"boolean needsPeerOverload(X509TrustManager m) { return m instanceof AdvancedTlsX509TrustManager; }","tryCatchPattern":"try { tm.checkClientTrusted(chain, authType); } catch (CertificateException e) { tm.checkClientTrusted(chain, authType, socket); }","preventionTips":["Always call the Socket/SSLEngine overloads with this trust manager","Supply a custom peer verifier for non-standard transports","Check TLS stack support for X509ExtendedTrustManager overloads"],"tags":["grpc","tls","trust-manager","unsupported-operation"],"backgroundTag":"unsupported-operation","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}