{"record":{"id":"491e4bd4cd9e767c","repo":"grpc/grpc-java","slug":"could-not-find-tls-alpn-provider-no-working-netty","errorCode":null,"errorMessage":"Could not find TLS ALPN provider; no working netty-tcnative, Conscrypt, or Jetty NPN/ALPN available","messagePattern":"Could not find TLS ALPN provider; no working netty-tcnative, Conscrypt, or Jetty NPN/ALPN available","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"netty/src/main/java/io/grpc/netty/GrpcSslContexts.java","lineNumber":257,"sourceCode":"   */\n  private static SslProvider defaultSslProvider() {\n    if (OpenSsl.isAvailable()) {\n      logger.log(Level.FINE, \"Selecting OPENSSL\");\n      return SslProvider.OPENSSL;\n    }\n    Provider provider = findJdkProvider();\n    if (provider != null) {\n      logger.log(Level.FINE, \"Selecting JDK with provider {0}\", provider);\n      return SslProvider.JDK;\n    }\n    logger.log(Level.INFO, \"Java 9 ALPN API unavailable (this may be normal)\");\n    logger.log(Level.INFO, \"netty-tcnative unavailable (this may be normal)\",\n        OpenSsl.unavailabilityCause());\n    logger.log(Level.INFO, \"Conscrypt not found (this may be normal)\",\n        ConscryptHolder.UNAVAILABILITY_CAUSE);\n    logger.log(Level.INFO, \"Jetty ALPN unavailable (this may be normal)\",\n        JettyTlsUtil.getJettyAlpnUnavailabilityCause());\n    throw new IllegalStateException(\n        \"Could not find TLS ALPN provider; \"\n        + \"no working netty-tcnative, Conscrypt, or Jetty NPN/ALPN available\");\n  }\n\n  private static Provider findJdkProvider() {\n    for (Provider provider : Security.getProviders(\"SSLContext.TLS\")) {\n      if (SUN_PROVIDER_NAME.equals(provider.getName())) {\n        if (JettyTlsUtil.isJettyAlpnConfigured()\n            || JettyTlsUtil.isJettyNpnConfigured()\n            || JettyTlsUtil.isJava9AlpnAvailable()) {\n          return provider;\n        }\n      } else if (IBM_PROVIDER_NAME.equals(provider.getName())\n          || OPENJSSE_PROVIDER_NAME.equals(provider.getName())\n          || BCJSSE_PROVIDER_NAME.equals(provider.getName())) {\n        if (JettyTlsUtil.isJava9AlpnAvailable()) {\n          return provider;\n        }","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/netty/src/main/java/io/grpc/netty/GrpcSslContexts.java#L239-L275","documentation":"defaultSslProvider() auto-detects a TLS ALPN-capable provider by probing netty-tcnative (OpenSSL), Conscrypt, and Jetty ALPN in order. If all three are unavailable it throws IllegalStateException, since gRPC requires one of them for HTTP/2 over TLS.","triggerScenarios":"Calling GrpcSslContexts.configure(builder) (default provider resolution) or building a Netty channel/server with TlsChannelCredentials/TlsServerCredentials on a JVM with none of the three providers present.","commonSituations":"Java 8 without Jetty ALPN agent and no Conscrypt/tcnative on the classpath; slim Docker images stripped of native libs; fat-jar packaging excluding native tcnative binaries; forgetting the conscrypt dependency.","solutions":["Add io.grpc:grpc-netty-shaded's companion netty-tcnative-boringssl-static to dependencies","Add org.conscrypt:conscrypt-openjdk-ribbon and register the provider","On Java 8, install the Jetty ALPN boot agent","Upgrade to Java 9+ and rely on JDK ALPN support"],"exampleFix":"// before: no TLS provider on classpath\n// after\nimplementation 'io.netty:netty-tcnative-boringssl-static:2.0.61.Final'\n// or\nimplementation 'org.conscrypt:conscrypt-openjdk-ribbon:2.5.2'","handlingStrategy":"validation","validationCode":"boolean tlsReady = OpenSsl.isAvailable() || ConscryptHolder.UNAVAILABILITY_CAUSE == null || JettyTlsUtil.isJettyAlpnAvailable() || JettyTlsUtil.isJava9AlpnAvailable(); if (!tlsReady) throw new IllegalStateException(\"No TLS ALPN provider on classpath\");","typeGuard":"boolean hasTlsProvider() { return OpenSsl.isAvailable() || isConscryptRegistered() || JettyTlsUtil.isJettyAlpnAvailable(); }","tryCatchPattern":"try { return GrpcSslContexts.configure(builder); } catch (IllegalStateException e) { log.severe(\"Add netty-tcnative-boringssl-static or conscrypt to dependencies\"); throw e; }","preventionTips":["Add netty-tcnative-boringssl-static or conscrypt-openjdk to every service deploying TLS","Verify native libraries survive shading/fat-jar packaging","Smoke-test TLS channel creation at app startup"],"tags":["grpc","tls","alpn","netty","missing-dependency"],"backgroundTag":"missing-optional-dependency","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}