{"record":{"id":"366a874eb4a12ebc","repo":"grpc/grpc-java","slug":"socketfactory-socketfactory-did-not-produce-an","errorCode":null,"errorMessage":"SocketFactory ${socketFactory} did not produce an SSLSocket: ${s.getClass()}","messagePattern":"SocketFactory (.+?) did not produce an SSLSocket: (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"okhttp/src/main/java/io/grpc/okhttp/OkHttpServerBuilder.java","lineNumber":533,"sourceCode":"\n    public static HandshakerSocketFactoryResult factory(HandshakerSocketFactory factory) {\n      return new HandshakerSocketFactoryResult(\n          Preconditions.checkNotNull(factory, \"factory\"), null);\n    }\n  }\n\n  static final class ClientCertRequestingSocketFactory extends SSLSocketFactory {\n    private final SSLSocketFactory socketFactory;\n    private final boolean required;\n\n    public ClientCertRequestingSocketFactory(SSLSocketFactory socketFactory, boolean required) {\n      this.socketFactory = Preconditions.checkNotNull(socketFactory, \"socketFactory\");\n      this.required = required;\n    }\n\n    private Socket apply(Socket s) throws IOException {\n      if (!(s instanceof SSLSocket)) {\n        throw new IOException(\n            \"SocketFactory \" + socketFactory + \" did not produce an SSLSocket: \" + s.getClass());\n      }\n      SSLSocket sslSocket = (SSLSocket) s;\n      if (required) {\n        sslSocket.setNeedClientAuth(true);\n      } else {\n        sslSocket.setWantClientAuth(true);\n      }\n      return sslSocket;\n    }\n\n    @Override public Socket createSocket(Socket s, String host, int port, boolean autoClose)\n        throws IOException {\n      return apply(socketFactory.createSocket(s, host, port, autoClose));\n    }\n\n    @Override public Socket createSocket(String host, int port) throws IOException {\n      return apply(socketFactory.createSocket(host, port));","sourceCodeStart":515,"sourceCodeEnd":551,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/okhttp/src/main/java/io/grpc/okhttp/OkHttpServerBuilder.java#L515-L551","documentation":"ClientCertRequestingSocketFactory (and related wrapper) wraps a base SSLSocketFactory but requires the sockets it produces to actually be SSLSocket instances so client-auth and protocol settings can be applied. If the configured socket factory yields a plain socket, apply() throws IOException stating the factory did not produce an SSLSocket.","triggerScenarios":"A custom javax.net.SocketFactory supplied via TlsServerCredentials.customSSLSocketFactory... style configuration returns a non-SSL Socket when createSocket is called during connection setup.","commonSituations":"Misconfigured custom socket factories, factories that delegate to the default factory but return a wrapped/plain socket, mocking or subclassing mistakes in test setups.","solutions":["Fix the custom SocketFactory so every createSocket overload returns an SSLSocket (typically obtained from an SSLContext's SSLSocketFactory)","Alternatively use TlsServerCredentials.keyManager/trustManager and let gRPC build the SSL socket itself","Log/inspect which factory instance is printed in the message to identify the faulty factory"],"exampleFix":"// before\nreturn new Socket();\n// after\nreturn sslContext.getSocketFactory().createSocket(host, port);","handlingStrategy":"validation","validationCode":"Socket test = mySocketFactory.createSocket();\nif (!(test instanceof SSLSocket)) throw new IllegalStateException(\"Factory must return SSLSocket\");","typeGuard":"function returnsSslSocket(f: javax.net.SocketFactory, s: Socket): boolean { return s instanceof javax.net.ssl.SSLSocket; }","tryCatchPattern":"try { server.start(); }\ncatch (IOException e) {\n  if (e.getMessage().startsWith(\"SocketFactory \")) { /* fix custom factory to return SSLSocket */ }\n}","preventionTips":["Have custom factories obtain sockets from SSLContext.getSocketFactory()","Unit-test every createSocket overload of custom factories","Prefer keyManager/trustManager over custom socket factories when possible"],"tags":["grpc","java","tls","sslsocket","socketfactory"],"backgroundTag":"tls-handshake-failure","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}