{"record":{"id":"298d33abeb83f740","repo":"grpc/grpc-java","slug":"verify-certificate-spki-in-default-validation-cont","errorCode":null,"errorMessage":"verify_certificate_spki in default_validation_context is not supported","messagePattern":"verify_certificate_spki in default_validation_context is not supported","errorType":"validation","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/XdsClusterResource.java","lineNumber":511,"sourceCode":"                + \"' not defined in the bootstrap file.\");\n      }\n      CertificateValidationContext certificateValidationContext = null;\n      if (commonTlsContext.hasValidationContext()) {\n        certificateValidationContext = commonTlsContext.getValidationContext();\n      } else if (commonTlsContext.hasCombinedValidationContext() && commonTlsContext\n          .getCombinedValidationContext().hasDefaultValidationContext()) {\n        certificateValidationContext = commonTlsContext.getCombinedValidationContext()\n            .getDefaultValidationContext();\n      }\n      if (certificateValidationContext != null) {\n        @SuppressWarnings(\"deprecation\") // gRFC A29 predates match_typed_subject_alt_names\n        int matchSubjectAltNamesCount = certificateValidationContext.getMatchSubjectAltNamesCount();\n        if (matchSubjectAltNamesCount > 0 && server) {\n          throw new ResourceInvalidException(\n              \"match_subject_alt_names only allowed in upstream_tls_context\");\n        }\n        if (certificateValidationContext.getVerifyCertificateSpkiCount() > 0) {\n          throw new ResourceInvalidException(\n              \"verify_certificate_spki in default_validation_context is not supported\");\n        }\n        if (certificateValidationContext.getVerifyCertificateHashCount() > 0) {\n          throw new ResourceInvalidException(\n              \"verify_certificate_hash in default_validation_context is not supported\");\n        }\n        if (certificateValidationContext.hasRequireSignedCertificateTimestamp()) {\n          throw new ResourceInvalidException(\n              \"require_signed_certificate_timestamp in default_validation_context is not \"\n                  + \"supported\");\n        }\n        if (certificateValidationContext.hasCrl()) {\n          throw new ResourceInvalidException(\"crl in default_validation_context is not supported\");\n        }\n        if (certificateValidationContext.hasCustomValidatorConfig()) {\n          throw new ResourceInvalidException(\n              \"custom_validator_config in default_validation_context is not supported\");\n        }","sourceCodeStart":493,"sourceCodeEnd":529,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/XdsClusterResource.java#L493-L529","documentation":"gRPC xDS rejects a Cluster's upstream/downstream TLS context whose default_validation_context (CertificateValidationContext) contains verify_certificate_spki entries. SPKI-pin based certificate verification is not implemented by grpc-java's xDS transport security, so a resource carrying it is invalid and the xDS client rejects the whole cluster resource with ResourceInvalidException.","triggerScenarios":"An LDS/CDS resource (via validateUpstreamTlsContext -> validateCommonTlsContext) sets CommonTlsContext.CertificateValidationContext.verify_certificate_spki (one or more base64 SPKI hashes) inside default_validation_context when configuring mTLS via upstream_tls_context.","commonSituations":"Envoy configs copied verbatim into gRPC xDS deployments; control planes (e.g. istiod, ads pipelines) generating Envoy-style CertificateValidationContext with SPKI pins; teams migrating from Envoy expecting feature parity in grpc-java xDS.","solutions":["Remove verify_certificate_spki from default_validation_context in the cluster's upstream_tls_context","Pin trust via trust_ca / ca_certificate_provider_file (root CA validation) instead of SPKI pins","Use match_subject_alt_names (upstream only) to restrict accepted server identities","Check grpc-java xDS docs/issue tracker for SPKI support before relying on it"],"exampleFix":"# before (upstream_tls_context.common_tls_context.validation_context)\nvalidation_context:\n  default_validation_context:\n    verify_certificate_spki:\n      - \"57l7MLNM1zHwTdOCQ0mVcOatsCJw\"\n  trust_ca: { ... }\n# after\nvalidation_context:\n  default_validation_context: {}\n  trust_ca: { ... }\n  match_subject_alt_names:\n    - { prefix: \"srv.example.com\" }","handlingStrategy":"validation","validationCode":"if (ctx.getDefaultValidationContext().getVerifyCertificateSpkiCount() > 0) {\n  throw new IllegalArgumentException(\"verify_certificate_spki unsupported by grpc-java xDS\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  cluster = XdsClusterResource.parse(resource);\n} catch (ResourceInvalidException e) {\n  logger.warn(\"Cluster rejected: {}\", e.getMessage());\n}","preventionTips":["Never copy Envoy CertificateValidationContext fields (spki/hash/crl/ct/custom validator) into grpc-java xDS configs","Restrict upstream identity with match_subject_alt_names instead of pinning","Keep trust anchored via trust_ca or ca_certificate_provider_file","Review grpc-java xDS supported TLS fields per release"],"tags":["xds","grpc-java","mtls","tls","unsupported-feature"],"backgroundTag":"unsupported-config-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}