{"record":{"id":"44d519a216efd3bb","repo":"grpc/grpc-java","slug":"jdkprovider-selected-but-java-9-alpn-unavaila","errorCode":null,"errorMessage":"${jdkProvider} selected, but Java 9+ ALPN unavailable","messagePattern":"(.+?) selected, but Java 9\\+ ALPN unavailable","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"netty/src/main/java/io/grpc/netty/GrpcSslContexts.java","lineNumber":218,"sourceCode":"    if (SUN_PROVIDER_NAME.equals(jdkProvider.getName())) {\n      // Jetty ALPN/NPN only supports one of NPN or ALPN\n      if (JettyTlsUtil.isJettyAlpnConfigured()) {\n        apc = ALPN;\n      } else if (JettyTlsUtil.isJettyNpnConfigured()) {\n        apc = NPN;\n      } else if (JettyTlsUtil.isJava9AlpnAvailable()) {\n        apc = ALPN;\n      } else {\n        throw new IllegalArgumentException(\n            jdkProvider.getName() + \" selected, but Java 9+ and Jetty NPN/ALPN unavailable\");\n      }\n    } else if (IBM_PROVIDER_NAME.equals(jdkProvider.getName())\n        || OPENJSSE_PROVIDER_NAME.equals(jdkProvider.getName())\n        || BCJSSE_PROVIDER_NAME.equals(jdkProvider.getName())) {\n      if (JettyTlsUtil.isJava9AlpnAvailable()) {\n        apc = ALPN;\n      } else {\n        throw new IllegalArgumentException(\n            jdkProvider.getName() + \" selected, but Java 9+ ALPN unavailable\");\n      }\n    } else if (ConscryptLoader.isConscrypt(jdkProvider)) {\n      apc = ALPN;\n      // TODO: Conscrypt triggers failures in the TrustManager.\n      // https://github.com/grpc/grpc-java/issues/7765\n      builder.protocols(\"TLSv1.2\");\n    } else {\n      throw new IllegalArgumentException(\"Unknown provider; can't configure: \" + jdkProvider);\n    }\n    return builder\n        .sslProvider(SslProvider.JDK)\n        .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE)\n        .applicationProtocolConfig(apc)\n        .sslContextProvider(jdkProvider)\n        .endpointIdentificationAlgorithm(DEFAULT_ENDPOINT_IDENTIFICATION_ALGORITHM);\n  }\n","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/netty/src/main/java/io/grpc/netty/GrpcSslContexts.java#L200-L236","documentation":"For JDK providers like IBM JSSE, OpenJSSE, or Bouncy Castle JSSE, gRPC relies exclusively on Java 9+ built-in ALPN. If isJava9AlpnAvailable() is false (running on Java 8 or a JVM without ALPN API), configure() throws this IllegalArgumentException.","triggerScenarios":"configure(builder, jdkProvider) where the provider name matches IBM_PROVIDER_NAME, OPENJSSE_PROVIDER_NAME, or BCJSSE_PROVIDER_NAME and Java 9 ALPN API is not present.","commonSituations":"Running on IBM JDK 8 with IBMJSSE; using openjsse or BouncyCastle JSSE on Java 8; enterprise environments pinned to these providers on legacy JVMs.","solutions":["Upgrade to Java 9+ (11/17 LTS recommended) where ALPN is built in","Switch to netty-tcnative with SslProvider.OPENSSL which supplies its own ALPN","Use Conscrypt as the JDK provider instead","Remove the custom JSSE provider so gRPC's default provider resolution applies"],"exampleFix":"// before\nSecurity.addProvider(new BouncyCastleJsseProvider());\nGrpcSslContexts.configure(builder, SslProvider.JDK);\n// after\nGrpcSslContexts.configure(builder, SslProvider.OPENSSL); // with netty-tcnative-boringssl-static","handlingStrategy":"validation","validationCode":"if (!JettyTlsUtil.isJava9AlpnAvailable()) { /* cannot use IBM/OpenJSSE/BCJSSE providers with gRPC */ }","typeGuard":"boolean canUseJsseProvider(Provider p) { return JettyTlsUtil.isJava9AlpnAvailable() || ConscryptLoader.isConscrypt(p); }","tryCatchPattern":"try { return GrpcSslContexts.configure(b, jdkProvider); } catch (IllegalArgumentException e) { return GrpcSslContexts.configure(b, SslProvider.OPENSSL); }","preventionTips":["Upgrade to Java 11/17 for built-in ALPN","Prefer netty-tcnative or Conscrypt over vendor JSSE providers","Test TLS handshake during CI on the target JVM"],"tags":["grpc","tls","alpn","jdk","provider"],"backgroundTag":"missing-optional-dependency","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}