{"record":{"id":"0e25b22e41259924","repo":"grpc/grpc-go","slug":"server-side-rpc-versions-are-not-compatible-with-t","errorCode":null,"errorMessage":"server-side RPC versions are not compatible with this client, local versions: %v, peer versions: %v","messagePattern":"server-side RPC versions are not compatible with this client, local versions: (.+?), peer versions: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"credentials/alts/alts.go","lineNumber":212,"sourceCode":"\t}\n\topts.BoundAccessToken = g.boundAccessToken\n\tchs, err := handshaker.NewClientHandshaker(ctx, hsConn, rawConn, opts)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\t// Close the handshaker since we have obtained a connection.\n\tdefer chs.Close()\n\tsecConn, authInfo, err := chs.ClientHandshake(ctx)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\taltsAuthInfo, ok := authInfo.(AuthInfo)\n\tif !ok {\n\t\treturn nil, nil, errors.New(\"client-side auth info is not of type alts.AuthInfo\")\n\t}\n\tmatch, _ := checkRPCVersions(opts.RPCVersions, altsAuthInfo.PeerRPCVersions())\n\tif !match {\n\t\treturn nil, nil, fmt.Errorf(\"server-side RPC versions are not compatible with this client, local versions: %v, peer versions: %v\", opts.RPCVersions, altsAuthInfo.PeerRPCVersions())\n\t}\n\treturn secConn, authInfo, nil\n}\n\n// ServerHandshake implements the server side ALTS handshaker.\nfunc (g *altsTC) ServerHandshake(rawConn net.Conn) (_ net.Conn, _ credentials.AuthInfo, err error) {\n\tif !vmOnGCP {\n\t\treturn nil, nil, ErrUntrustedPlatform\n\t}\n\t// Connecting to ALTS handshaker service.\n\thsConn, err := service.Dial(g.hsAddress)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\t// Do not close hsConn since it's shared with other handshakes.\n\n\tctx, cancel := context.WithTimeout(context.Background(), defaultTimeout)\n\tdefer cancel()","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/credentials/alts/alts.go#L194-L230","documentation":"In the ALTS client handshake (alts.go:210-212), after a successful TLS-like handshake the client compares its negotiated RPC protocol versions against the peer's via checkRPCVersions. If the [min,max] version windows don't overlap, the secure connection is rejected. This is an ALTS (Google's GCP transport security) compatibility check.","triggerScenarios":"Using credentials/alts client-side to talk to an ALTS server whose RPC protocol version range doesn't intersect the client's compiled-in range (maxRPCVersion/minRPCVersion in alts.go). Happens across version-skewed gRPC builds.","commonSituations":"Client and server built from gRPC versions with different ALTS protocol versions; a non-GCP peer pretending to support ALTS; an old server that predates a protocol bump.","solutions":["Align client and server gRPC (and ALTS) versions so their RPC version windows overlap.","If ALTS isn't required, switch both sides to TLS credentials or insecure for testing.","Run ALTS only on GCP where the handshaker service negotiates a compatible version."],"exampleFix":"// before\ncreds, _ := alts.NewClientCreds(alts.ClientHandshakerOptions{...})\ngrpc.WithTransportCredentials(creds)  // against mismatched ALTS server\n// after\ncreds := credentials.NewTLS(&tls.Config{ServerName: \"svc.example\"})\ngrpc.WithTransportCredentials(creds)","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"secConn, _, err := creds.ClientHandshake(ctx, authority, rawConn)\nif err != nil {\n    if strings.Contains(err.Error(), \"RPC versions are not compatible\") {\n        log.Printf(\"ALTS version mismatch with peer; align gRPC versions\")\n    }\n    return err\n}","preventionTips":["Pin client and server to a compatible gRPC/ALTS release.","Use ALTS only within a GCP fleet of known versions.","For cross-version or external traffic, prefer TLS."],"tags":["go","grpc","alts","security","versioning"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}