{"record":{"id":"75648997044cdc6e","repo":"alibaba/canal","slug":"unsupported-ssl-mode","errorCode":null,"errorMessage":"Unsupported ssl mode: {}","messagePattern":"Unsupported ssl mode: (.+?)","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"driver/src/main/java/com/alibaba/otter/canal/parse/driver/mysql/socket/BioSocketChannelPool.java","lineNumber":50,"sourceCode":"\n    private static final Logger logger = LoggerFactory.getLogger(BioSocketChannelPool.class);\n\n    public static BioSocketChannel open(SocketAddress address) throws Exception {\n        Socket socket = createSocket(address);\n        return new BioSocketChannel(socket);\n    }\n\n    public static BioSocketChannel openSsl(Socket socket, SslInfo sslInfo) throws Exception {\n        SslMode sslMode = sslInfo.getSslMode();\n        switch (sslMode) {\n            case REQUIRED:\n            case PREFERRED:\n            case VERIFY_CA:\n            case VERIFY_IDENTITY:\n                SSLSocket sslSocket = createSslSocket(socket, sslInfo);\n                return new BioSocketChannel(sslSocket);\n            default:\n                throw new UnsupportedOperationException(\"Unsupported ssl mode: \" + sslMode);\n        }\n    }\n\n    private static Socket createSocket(SocketAddress address) throws IOException {\n        Socket socket;\n        socket = new Socket();\n        socket.setSoTimeout(BioSocketChannel.SO_TIMEOUT);\n        socket.setTcpNoDelay(true);\n        socket.setKeepAlive(true);\n        socket.setReuseAddress(true);\n        socket.connect(address, BioSocketChannel.DEFAULT_CONNECT_TIMEOUT);\n        return socket;\n    }\n\n    /**\n     * from JDBC driver com.mysql.cj.protocol.ExportControlled#performTlsHandshake\n     * com.mysql.cj.protocol.ExportControlled#getSSLContext\n     *","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/alibaba/canal/blob/87be50e87686a3e8af08c368d0e1ffd1f59eb04a/driver/src/main/java/com/alibaba/otter/canal/parse/driver/mysql/socket/BioSocketChannelPool.java#L32-L68","documentation":"Thrown by BioSocketChannelPool.openSsl when the configured SslMode is not one of REQUIRED, PREFERRED, VERIFY_CA, or VERIFY_IDENTITY. The switch has no case for DISABLED (or any future/custom mode), so reaching openSsl with such a mode is a programming/config contradiction: you asked to open an SSL socket with a non-SSL mode.","triggerScenarios":"Calling openSsl(socket, sslInfo) while sslInfo.getSslMode() returns DISABLED (or null/unknown). Typically the caller chose the SSL path (openSsl) but the SslInfo says SSL is off, which is inconsistent.","commonSituations":"Config sets sslMode=DISABLED yet the code path forces openSsl; a default SslInfo whose mode was never set; enum value added in a newer version that this build does not know; logic that picks openSsl without consulting sslMode first.","solutions":["When sslMode is DISABLED/PREFERRED-off, call the plain open(address) path instead of openSsl.","Default SslMode to REQUIRED or PREFERRED when SSL is enabled and validate before dispatching.","Ensure sslInfo.getSslMode() is never null before openSsl is called.","Upgrade the driver so its SslMode enum matches the configured values."],"exampleFix":"// before\nBioSocketChannel ch = BioSocketChannelPool.openSsl(sock, sslInfo); // sslMode=DISABLED\n\n// after\nBioSocketChannel ch = (sslInfo == null || sslInfo.getSslMode() == SslMode.DISABLED)\n    ? BioSocketChannelPool.open(address)\n    : BioSocketChannelPool.openSsl(sock, sslInfo);","handlingStrategy":"validation","validationCode":"SslMode mode = (sslInfo == null) ? null : sslInfo.getSslMode();\nif (mode == SslMode.DISABLED || mode == null) {\n    channel = BioSocketChannelPool.open(address); // plain\n} else {\n    channel = BioSocketChannelPool.openSsl(sock, sslInfo);\n}","typeGuard":"public static boolean supportsSslOpen(SslMode m) {\n    return m == SslMode.REQUIRED || m == SslMode.PREFERRED\n        || m == SslMode.VERIFY_CA || m == SslMode.VERIFY_IDENTITY;\n}","tryCatchPattern":"try {\n    ch = BioSocketChannelPool.openSsl(sock, sslInfo);\n} catch (UnsupportedOperationException e) {\n    if (e.getMessage().startsWith(\"Unsupported ssl mode\")) {\n        // fix config: set a supported SslMode or use open()\n    }\n    throw e;\n}","preventionTips":["Only call openSsl when sslMode is one of the four supported modes.","Default SslMode explicitly in config rather than leaving it unset.","Route DISABLED/PREFERRED-off through the plain open() path."],"tags":["network","ssl","tls","config","mysql"],"backgroundTag":null,"analyzedSha":"87be50e87686a3e8af08c368d0e1ffd1f59eb04a","analyzedAt":"2026-08-14T04:30:11.918Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}