{"record":{"id":"5e6f8fcbacc71cbc","repo":"grpc/grpc-java","slug":"response-from-s2a-server-has-ean-error-d-with-err","errorCode":null,"errorMessage":"response from S2A server has ean error %d with error message %s.","messagePattern":"response from S2A server has ean error (.+?) with error message (.+?)\\.","errorType":"exception","errorClass":"S2AConnectionException","httpStatus":null,"severity":"error","filePath":"s2a/src/main/java/io/grpc/s2a/internal/handshaker/SslContextFactory.java","lineNumber":130,"sourceCode":"    SessionReq.Builder reqBuilder = SessionReq.newBuilder();\n    if (localIdentity.isPresent()) {\n      reqBuilder.setLocalIdentity(localIdentity.get().getIdentity());\n    }\n    Optional<AuthenticationMechanism> authMechanism =\n        GetAuthenticationMechanisms.getAuthMechanism(localIdentity,\n        GetAuthenticationMechanisms.TOKEN_MANAGER);\n    if (authMechanism.isPresent()) {\n      reqBuilder.addAuthenticationMechanisms(authMechanism.get());\n    }\n    SessionResp resp =\n        stub.send(\n            reqBuilder\n                .setGetTlsConfigurationReq(\n                    GetTlsConfigurationReq.newBuilder()\n                        .setConnectionSide(ConnectionSide.CONNECTION_SIDE_CLIENT))\n                .build());\n    if (resp.hasStatus() && resp.getStatus().getCode() != 0) {\n      throw new S2AConnectionException(\n          String.format(\n              \"response from S2A server has ean error %d with error message %s.\",\n              resp.getStatus().getCode(), resp.getStatus().getDetails()));\n    }\n    if (!resp.getGetTlsConfigurationResp().hasClientTlsConfiguration()) {\n      throw new S2AConnectionException(\n          \"Response from S2A server does NOT contain ClientTlsConfiguration.\");\n    }\n    return resp.getGetTlsConfigurationResp().getClientTlsConfiguration();\n  }\n\n  private static void configureSslContextWithClientTlsConfiguration(\n      GetTlsConfigurationResp.ClientTlsConfiguration clientTlsConfiguration,\n      SslContextBuilder sslContextBuilder)\n      throws CertificateException,\n          IOException,\n          KeyStoreException,\n          NoSuchAlgorithmException,","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/s2a/src/main/java/io/grpc/s2a/internal/handshaker/SslContextFactory.java#L112-L148","documentation":"S2AConnectionException thrown by getClientTlsConfigurationFromS2A when the S2A (Service-to-Agent) server's GetTlsConfiguration response carries a non-zero status code. The S2A server failed to produce a client-side TLS configuration, so gRPC cannot build the client SSLContext. The status code and server-provided details are embedded in the message.","triggerScenarios":"Calling SslContextFactory.createForClient() when the S2A server responds to a CONNECTION_SIDE_CLIENT GetTlsConfigurationReq with resp.getStatus().getCode() != 0.","commonSituations":"S2A server misconfiguration, the S2A service cannot access the requested identity/credentials, or the S2A backend is degraded/unhealthy during mTLS handshakes.","solutions":["Read the %d code and %s details in the message to identify the server-side failure cause","Check S2A server logs for the corresponding request failure","Verify the S2A server is healthy and has access to the required TLS material/identity","Confirm network connectivity and correct S2A target address configuration"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Verify S2A reachability before building the context\nS2AStub stub = /* ... */;\nGetTlsConfigurationResp resp = stub.getTlsConfiguration(/* client req */);\nif (resp.hasStatus() && resp.getStatus().getCode() != 0) {\n  throw new IllegalStateException(\"S2A unhealthy: \" + resp.getStatus().getDetails());\n}","typeGuard":null,"tryCatchPattern":"try {\n  SslContext ctx = SslContextFactory.createForClient();\n} catch (S2AConnectionException e) {\n  logger.atSevere().withCause(e).log(\"S2A returned error status; check S2A server health\");\n  // fall back to locally-configured TLS or fail fast\n}","preventionTips":["Monitor S2A server health before/while creating channels","Pre-validate S2A target address and network reachability","Log status details from S2A to catch server-side degradation early"],"tags":["grpc","s2a","tls","network"],"backgroundTag":"api-error-response","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}