{"record":{"id":"1133e2b0189dd0c5","repo":"pinpoint-apm/pinpoint","slug":"ciphersuites-must-not-be-empty","errorCode":null,"errorMessage":"cipherSuites must not be empty","messagePattern":"cipherSuites must not be empty","errorType":"validation","errorClass":"SSLException","httpStatus":null,"severity":"error","filePath":"grpc/src/main/java/com/navercorp/pinpoint/grpc/security/SslContextFactory.java","lineNumber":116,"sourceCode":"    }\n\n\n    private SslContext createSslContext(SslContextBuilder sslContextBuilder, SslProvider sslProvider) throws SSLException {\n        sslContextBuilder.sslProvider(sslProvider);\n\n        sslContextBuilder.protocols(SecurityConstants.DEFAULT_SUPPORT_PROTOCOLS.toArray(new String[0]));\n        sslContextBuilder.ciphers(SecurityConstants.DEFAULT_SUPPORT_CIPHER_SUITE, SupportedCipherSuiteFilter.INSTANCE);\n\n        SslContextBuilder configure = GrpcSslContexts.configure(sslContextBuilder, sslProvider);\n        return configure.build();\n    }\n\n    private void assertValidCipherSuite(SslContext sslContext) throws SSLException {\n        Objects.requireNonNull(sslContext, \"sslContext must not be null\");\n\n        List<String> supportedCipherSuiteList = sslContext.cipherSuites();\n        if (CollectionUtils.isEmpty(supportedCipherSuiteList)) {\n            throw new SSLException(\"cipherSuites must not be empty\");\n        }\n\n        for (String cipherSuite : supportedCipherSuiteList) {\n            if (SecurityConstants.BAD_CIPHER_SUITE_LIST.contains(cipherSuite)) {\n                throw new SSLException(cipherSuite + \" is not safe. Please check this url.(https://httpwg.org/specs/rfc7540.html#BadCipherSuites)\");\n            }\n        }\n\n        LOGGER.info(\"Support cipher list : {} {}\", sslContext, supportedCipherSuiteList);\n    }\n\n    SslProvider getSslProvider(String providerType) throws SSLException {\n        if (StringUtils.isEmpty(providerType)) {\n            return SslProvider.OPENSSL;\n        }\n\n        if (SslProvider.OPENSSL.name().equalsIgnoreCase(providerType)) {\n            return SslProvider.OPENSSL;","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/pinpoint-apm/pinpoint/blob/744c3d3075e595656abb1ae331ad2c0e4c9eb996/grpc/src/main/java/com/navercorp/pinpoint/grpc/security/SslContextFactory.java#L98-L134","documentation":"SslContextFactory.assertValidCipherSuite builds a netty SslContext and then checks sslContext.cipherSuites(); if the resulting context advertises no cipher suites, it throws SSLException(\"cipherSuites must not be empty\"). A TLS context with zero ciphers can never complete a handshake, so the factory refuses to return it during forServer.","triggerScenarios":"Calling SslContextFactory.forServer with an SslProvider/protocol configuration (e.g. JDK provider with restricted protocols, or FIPS/restricted JCE) that yields an SslContext whose cipherSuites() list is empty.","commonSituations":"Running on a JVM with a restricted or FIPS crypto policy that disables all default TLS ciphers; misconfigured enabled protocols that exclude every cipher; unusual netty-transport-native builds where no cipher provider is available.","solutions":["Inspect the JVM's crypto policy (java.security, crypto.policy) and restore/enable TLS cipher availability.","Try the other SslProvider (e.g. switch between JDK and OPENSSL) via the SSL provider configuration.","Update to a JCE/netty version whose supported cipher list is non-empty for your configured protocols.","Verify enabled TLS protocol settings (e.g. TLSv1.2) actually have ciphers available in your environment."],"exampleFix":"// before (empty cipher env, JDK provider)\nproviderType=JDK\n// after\nproviderType=OPENSSL","handlingStrategy":"try-catch","validationCode":"// Pre-check: list ciphers the JVM can actually use\nfor (String c : javax.net.ssl.SSLContext.getDefault().getSupportedSSLParameters().getCipherSuites()) {\n    LOG.debug(\"JVM cipher: {}\", c);\n}","typeGuard":null,"tryCatchPattern":"try {\n    sslContext = SslContextFactory.forServer(...);\n} catch (SSLException e) {\n    LOG.error(\"SSL context invalid: {}\", e.getMessage());\n    throw new IllegalStateException(\"TLS setup failed, check crypto policy/provider\", e);\n}","preventionTips":["Keep JCE/crypto policy files and JDK up to date.","Ensure netty-tcnative or a working cipher provider is on the classpath when using OpenSSL provider.","Test TLS setup in a smoke check at startup, not on first connection."],"tags":["grpc","ssl","cipher-suites","tls"],"backgroundTag":"empty-required-field","analyzedSha":"744c3d3075e595656abb1ae331ad2c0e4c9eb996","analyzedAt":"2026-09-07T18:48:45.289Z","contentChangedAt":"2026-09-07T18:48:45.289Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}