{"record":{"id":"33d77241754e10b0","repo":"grpc/grpc-java","slug":"jdkprovider-selected-but-java-9-and-jetty-npn","errorCode":null,"errorMessage":"${jdkProvider} selected, but Java 9+ and Jetty NPN/ALPN unavailable","messagePattern":"(.+?) selected, but Java 9\\+ and Jetty NPN/ALPN unavailable","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"netty/src/main/java/io/grpc/netty/GrpcSslContexts.java","lineNumber":209,"sourceCode":"\n  /**\n   * Set ciphers and APN appropriate for gRPC. Precisely what is set is permitted to change, so if\n   * an application requires particular settings it should override the options set here. For\n   * client builders, HTTPS endpoint identification is enabled by default.\n   */\n  @CanIgnoreReturnValue\n  public static SslContextBuilder configure(SslContextBuilder builder, Provider jdkProvider) {\n    ApplicationProtocolConfig apc;\n    if (SUN_PROVIDER_NAME.equals(jdkProvider.getName())) {\n      // Jetty ALPN/NPN only supports one of NPN or ALPN\n      if (JettyTlsUtil.isJettyAlpnConfigured()) {\n        apc = ALPN;\n      } else if (JettyTlsUtil.isJettyNpnConfigured()) {\n        apc = NPN;\n      } else if (JettyTlsUtil.isJava9AlpnAvailable()) {\n        apc = ALPN;\n      } else {\n        throw new IllegalArgumentException(\n            jdkProvider.getName() + \" selected, but Java 9+ and Jetty NPN/ALPN unavailable\");\n      }\n    } else if (IBM_PROVIDER_NAME.equals(jdkProvider.getName())\n        || OPENJSSE_PROVIDER_NAME.equals(jdkProvider.getName())\n        || BCJSSE_PROVIDER_NAME.equals(jdkProvider.getName())) {\n      if (JettyTlsUtil.isJava9AlpnAvailable()) {\n        apc = ALPN;\n      } else {\n        throw new IllegalArgumentException(\n            jdkProvider.getName() + \" selected, but Java 9+ ALPN unavailable\");\n      }\n    } else if (ConscryptLoader.isConscrypt(jdkProvider)) {\n      apc = ALPN;\n      // TODO: Conscrypt triggers failures in the TrustManager.\n      // https://github.com/grpc/grpc-java/issues/7765\n      builder.protocols(\"TLSv1.2\");\n    } else {\n      throw new IllegalArgumentException(\"Unknown provider; can't configure: \" + jdkProvider);","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/netty/src/main/java/io/grpc/netty/GrpcSslContexts.java#L191-L227","documentation":"When a Conscrypt provider is selected at the JDK level, gRPC still needs an ALPN application-protocol mechanism. If Jetty NPN is not configured and Java 9+ ALPN is unavailable (i.e. Java 8 without the Jetty ALPN agent), this IllegalArgumentException is thrown.","triggerScenarios":"configure(builder, jdkProvider) where jdkProvider is Conscrypt (not via the JDK_PROVIDER default path that allows Conscrypt workaround) and neither Jetty NPN nor Java 9 ALPN is available.","commonSituations":"Conscrypt registered as a security provider on Java 8 without the Jetty ALPN boot agent; containers on old JREs; explicitly selecting the Conscrypt JDK provider for TLS while lacking ALPN support.","solutions":["Upgrade to Java 9+ where ALPN is built in","On Java 8, add the Jetty ALPN boot jar (-Xbootclasspath) matching the JDK version","Use SslProvider.OPENSSL with netty-tcnative, which handles ALPN itself"],"exampleFix":"// before (Java 8, no ALPN agent)\njava -jar app.jar\n// after\njava -Xbootclasspath/p:alpn-boot-8u252.jar -jar app.jar","handlingStrategy":"validation","validationCode":"if (Conscrypt.isAvailable() && !JettyTlsUtil.isJettyNpnConfigured() && !JettyTlsUtil.isJava9AlpnAvailable()) { /* need Jetty ALPN agent or Java 9+ */ }","typeGuard":"boolean conscryptUsable() { return JettyTlsUtil.isJettyNpnConfigured() || JettyTlsUtil.isJava9AlpnAvailable(); }","tryCatchPattern":"try { GrpcSslContexts.configure(b, SslProvider.JDK); } catch (IllegalArgumentException e) { throw new IllegalStateException(\"Add Jetty ALPN boot jar or upgrade to Java 9+\", e); }","preventionTips":["Always pair Conscrypt-on-Java-8 with the Jetty ALPN boot agent","Check JettyTlsUtil.isJava9AlpnAvailable() at startup","Or simply use SslProvider.OPENSSL with tcnative"],"tags":["grpc","tls","alpn","conscrypt","jdk"],"backgroundTag":"missing-optional-dependency","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}