{"record":{"id":"09c16fa7f5f294ab","repo":"grpc/grpc-go","slug":"security-configuration-on-the-client-side-does-not","errorCode":null,"errorMessage":"security configuration on the client-side does not contain root certificate provider instance name","messagePattern":"security configuration on the client-side does not contain root certificate provider instance name","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/xdsclient/xdsresource/unmarshal_cds.go","lineNumber":418,"sourceCode":"\tsc, err1 := securityConfigFromCommonTLSContextUsingNewFields(common, server)\n\tif sc == nil || sc.Equal(&SecurityConfig{}) {\n\t\tvar err error\n\t\tsc, err = securityConfigFromCommonTLSContextWithDeprecatedFields(common, server)\n\t\tif err != nil {\n\t\t\t// Retain the validation error from using the new fields.\n\t\t\treturn nil, errors.Join(err1, fmt.Errorf(\"failed to parse config using deprecated fields: %v\", err))\n\t\t}\n\t}\n\tif sc != nil {\n\t\t// sc == nil is a valid case where the control plane has not sent us any\n\t\t// security configuration. xDS creds will use fallback creds.\n\t\tif server {\n\t\t\tif sc.IdentityInstanceName == \"\" {\n\t\t\t\treturn nil, errors.New(\"security configuration on the server-side does not contain identity certificate provider instance name\")\n\t\t\t}\n\t\t} else {\n\t\t\tif !sc.UseSystemRootCerts && sc.RootInstanceName == \"\" {\n\t\t\t\treturn nil, errors.New(\"security configuration on the client-side does not contain root certificate provider instance name\")\n\t\t\t}\n\t\t}\n\t}\n\treturn sc, nil\n}\n\nfunc securityConfigFromCommonTLSContextWithDeprecatedFields(common *v3tlspb.CommonTlsContext, server bool) (*SecurityConfig, error) {\n\t// The `CommonTlsContext` contains a\n\t// `tls_certificate_certificate_provider_instance` field of type\n\t// `CertificateProviderInstance`, which contains the provider instance name\n\t// and the certificate name to fetch identity certs.\n\tsc := &SecurityConfig{}\n\tif identity := common.GetTlsCertificateCertificateProviderInstance(); identity != nil {\n\t\tsc.IdentityInstanceName = identity.GetInstanceName()\n\t\tsc.IdentityCertName = identity.GetCertificateName()\n\t}\n\n\t// The `CommonTlsContext` contains a `validation_context_type` field which","sourceCodeStart":400,"sourceCodeEnd":436,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/xdsclient/xdsresource/unmarshal_cds.go#L400-L436","documentation":"Returned by securityConfigFromCommonTLSContext (unmarshal_cds.go:417-418) for a client-side security config when the root certificate provider instance name is empty AND UseSystemRootCerts is false. Clients must validate the server cert, so a security block without either a root provider or system roots is rejected. The client branch (server==false) enforces this after field parsing.","triggerScenarios":"A client-side CommonTlsContext (UpstreamTlsContext) yields a non-nil SecurityConfig with RootInstanceName==\"\" and UseSystemRootCerts false. Reached when no validation_context certificate-provider-instance and no system-roots opt-in are configured.","commonSituations":"Control plane sets an identity cert but omits the validation/root context; intending to use system roots but not enabling the UseSystemRootCerts flag; a bootstrap missing the root cert provider.","solutions":["Add a validation_context with a certificate_provider_instance.instance_name (root cert provider) to the client CommonTlsContext.","If you want the OS trust store, enable the system-roots option (so UseSystemRootCerts becomes true) instead of leaving the root context empty.","Verify the referenced root cert provider is registered in bootstrap."],"exampleFix":"// before\n//   common_tls_context: { tls_certificate_certificate_provider_instance: {...} }  // no validation\n// after\n//   common_tls_context: {\n//     tls_certificate_certificate_provider_instance: {...},\n//     validation_context: { certificate_provider_instance: { instance_name: \"default\", certificate_name: \"ca\" } }\n//   }","handlingStrategy":"validation","validationCode":"func clientSecurityHasRoots(sc *SecurityConfig) bool {\n    return sc != nil && (sc.UseSystemRootCerts || sc.RootInstanceName != \"\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set a validation_context root provider (or enable system roots) for client TLS configs.","Confirm the root cert provider is registered in bootstrap.","Test client mTLS handshakes against the configured CA before rollout."],"tags":["xds","tls","mtls","security","config","client"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}