{"record":{"id":"72301b27093f8565","repo":"grpc/grpc-java","slug":"unknown-provider-can-t-configure-jdkprovider","errorCode":null,"errorMessage":"Unknown provider; can't configure: ${jdkProvider}","messagePattern":"Unknown provider; can't configure: (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"netty/src/main/java/io/grpc/netty/GrpcSslContexts.java","lineNumber":227,"sourceCode":"        throw new IllegalArgumentException(\n            jdkProvider.getName() + \" selected, but Java 9+ and Jetty NPN/ALPN unavailable\");\n      }\n    } else if (IBM_PROVIDER_NAME.equals(jdkProvider.getName())\n        || OPENJSSE_PROVIDER_NAME.equals(jdkProvider.getName())\n        || BCJSSE_PROVIDER_NAME.equals(jdkProvider.getName())) {\n      if (JettyTlsUtil.isJava9AlpnAvailable()) {\n        apc = ALPN;\n      } else {\n        throw new IllegalArgumentException(\n            jdkProvider.getName() + \" selected, but Java 9+ ALPN unavailable\");\n      }\n    } else if (ConscryptLoader.isConscrypt(jdkProvider)) {\n      apc = ALPN;\n      // TODO: Conscrypt triggers failures in the TrustManager.\n      // https://github.com/grpc/grpc-java/issues/7765\n      builder.protocols(\"TLSv1.2\");\n    } else {\n      throw new IllegalArgumentException(\"Unknown provider; can't configure: \" + jdkProvider);\n    }\n    return builder\n        .sslProvider(SslProvider.JDK)\n        .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE)\n        .applicationProtocolConfig(apc)\n        .sslContextProvider(jdkProvider)\n        .endpointIdentificationAlgorithm(DEFAULT_ENDPOINT_IDENTIFICATION_ALGORITHM);\n  }\n\n  /**\n   * Returns OpenSSL if available, otherwise returns the JDK provider.\n   */\n  private static SslProvider defaultSslProvider() {\n    if (OpenSsl.isAvailable()) {\n      logger.log(Level.FINE, \"Selecting OPENSSL\");\n      return SslProvider.OPENSSL;\n    }\n    Provider provider = findJdkProvider();","sourceCodeStart":209,"sourceCodeEnd":245,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/netty/src/main/java/io/grpc/netty/GrpcSslContexts.java#L209-L245","documentation":"After checking known JDK TLS providers (Conscrypt, IBM, OpenJSSE, BCJSSE, default SunJSSE paths), any unrecognized provider name falls through to this IllegalArgumentException because gRPC cannot determine a safe ALPN configuration for it.","triggerScenarios":"configure(builder, jdkProvider) receiving a JDK SSLContext.TLS provider whose name matches none of the known cases (e.g. a custom or third-party JSSE provider).","commonSituations":"Registering a custom JSSE implementation; unusual vendor JDKs; a provider whose getName() differs from expected constants after vendor rename.","solutions":["Use a supported provider: Conscrypt, the platform default (SunJSSE), or netty-tcnative","Call the no-arg configure(builder) overload and let gRPC choose the provider","Use SslProvider.OPENSSL to bypass JDK provider detection entirely"],"exampleFix":"// before\nProvider custom = new MyCustomJsseProvider();\nGrpcSslContexts.configure(builder, custom);\n// after\nGrpcSslContexts.configure(builder); // auto-selects a supported provider","handlingStrategy":"try-catch","validationCode":"String name = jdkProvider.getName(); boolean known = name.equals(\"SunJSSE\") || name.contains(\"Conscrypt\") || name.equals(\"IBMJSSE2\") || name.equals(\"OpenJSSE\") || name.equals(\"BCJSSE\");","typeGuard":"boolean isKnownProvider(Provider p) { return ConscryptLoader.isConscrypt(p) || p.getClass().getName().startsWith(\"com.sun.net.ssl\"); }","tryCatchPattern":"try { return GrpcSslContexts.configure(b, jdkProvider); } catch (IllegalArgumentException e) { return GrpcSslContexts.configure(b, SslProvider.OPENSSL); }","preventionTips":["Use only well-known TLS providers with gRPC","Remove experimental/custom JSSE providers from the JVM","Prefer OpenSSL (tcnative) provider path"],"tags":["grpc","tls","jdk","provider","invalid-argument"],"backgroundTag":"unsupported-enum-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}