{"record":{"id":"27938413260411e6","repo":"grpc/grpc-java","slug":"downstream-tls-context-with-require-sni-is-not-sup","errorCode":null,"errorMessage":"downstream-tls-context with require-sni is not supported","messagePattern":"downstream-tls-context with require-sni is not supported","errorType":"exception","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/XdsListenerResource.java","lineNumber":307,"sourceCode":"        httpConnectionManager,\n        downstreamTlsContext,\n        tlsContextManager\n    );\n  }\n\n  @VisibleForTesting\n  static DownstreamTlsContext validateDownstreamTlsContext(\n      DownstreamTlsContext downstreamTlsContext, Set<String> certProviderInstances)\n      throws ResourceInvalidException {\n    if (downstreamTlsContext.hasCommonTlsContext()) {\n      validateCommonTlsContext(downstreamTlsContext.getCommonTlsContext(), certProviderInstances,\n          true);\n    } else {\n      throw new ResourceInvalidException(\n          \"common-tls-context is required in downstream-tls-context\");\n    }\n    if (downstreamTlsContext.hasRequireSni()) {\n      throw new ResourceInvalidException(\n          \"downstream-tls-context with require-sni is not supported\");\n    }\n    DownstreamTlsContext.OcspStaplePolicy ocspStaplePolicy = downstreamTlsContext\n        .getOcspStaplePolicy();\n    if (ocspStaplePolicy != DownstreamTlsContext.OcspStaplePolicy.UNRECOGNIZED\n        && ocspStaplePolicy != DownstreamTlsContext.OcspStaplePolicy.LENIENT_STAPLING) {\n      throw new ResourceInvalidException(\n          \"downstream-tls-context with ocsp_staple_policy value \" + ocspStaplePolicy.name()\n              + \" is not supported\");\n    }\n    return downstreamTlsContext;\n  }\n\n  private static void validateFilterChainMatchForUniqueness(\n      Set<FilterChainMatch> filterChainMatchSet,\n      FilterChainMatch filterChainMatch) throws ResourceInvalidException {\n    // Flattens complex FilterChainMatch into a list of simple FilterChainMatch'es.\n    List<FilterChainMatch> crossProduct = getCrossProduct(filterChainMatch);","sourceCodeStart":289,"sourceCodeEnd":325,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/XdsListenerResource.java#L289-L325","documentation":"gRPC xDS does not support the require_sni (Server Name Indication requirement) flag in downstream TLS contexts. Even if common_tls_context is valid, a DownstreamTlsContext carrying require_sni causes validateDownstreamTlsContext to throw ResourceInvalidException and the filter chain to be rejected.","triggerScenarios":"A FilterChain's DownstreamTlsContext has the require_sni field set (hasRequireSni() is true), regardless of value, during server-side listener validation.","commonSituations":"Envoy configs using SNI-based filter chain selection that enable require_sni on TLS contexts; control planes that copy the same TLS context template to every protocol; multi-tenant gateways relying on SNI routing.","solutions":["Remove the require_sni field from downstream_tls_context in the LDS resource","Achieve SNI-like selection via filter_chain_match server_names instead of require_sni","Split SNI-specific routing into separate filter chains with distinct filter_chain_match rules"],"exampleFix":"# before\ndownstream_tls_context:\n  common_tls_context: {...}\n  require_sni: true\n# after\ndownstream_tls_context:\n  common_tls_context: {...}\nfilter_chain_match:\n  server_names: [\"example.com\"]","handlingStrategy":"validation","validationCode":"if (tlsCtx.hasRequireSni()) {\n  throw new IllegalArgumentException(\n      \"require_sni is unsupported by gRPC xDS; use filter_chain_match.server_names\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  listener = XdsListenerResource.parseServerSideListener(proto, ...);\n} catch (ResourceInvalidException e) {\n  if (e.getMessage().contains(\"require-sni is not supported\")) {\n    logger.warn(\"Strip require_sni and use filter_chain_match server_names\", e);\n  }\n}","preventionTips":["Never set require_sni in downstream_tls_context for gRPC consumers","Implement SNI routing with filter_chain_match.server_names","Lint LDS resources against gRPC xDS unsupported fields"],"tags":["xds","grpc","tls","sni","unsupported"],"backgroundTag":"feature-not-enabled","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}