{"record":{"id":"76d057b28628cb0c","repo":"grpc/grpc-java","slug":"unsupported-configurations-in-downstreamtlscontext","errorCode":null,"errorMessage":"Unsupported configurations in DownstreamTlsContext!","messagePattern":"Unsupported configurations in DownstreamTlsContext!","errorType":"validation","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/internal/security/ServerSslContextProviderFactory.java","lineNumber":59,"sourceCode":"    this.certProviderServerSslContextProviderFactory = factory;\n  }\n\n  /** Creates a SslContextProvider from the given DownstreamTlsContext. */\n  @Override\n  public SslContextProvider create(\n      DownstreamTlsContext downstreamTlsContext) {\n    checkNotNull(downstreamTlsContext, \"downstreamTlsContext\");\n    checkNotNull(\n        downstreamTlsContext.getCommonTlsContext(),\n        \"downstreamTlsContext should have CommonTlsContext\");\n    if (CommonTlsContextUtil.hasCertProviderInstance(\n        downstreamTlsContext.getCommonTlsContext())) {\n      return certProviderServerSslContextProviderFactory.getProvider(\n          downstreamTlsContext,\n          bootstrapInfo.node().toEnvoyProtoNode(),\n          bootstrapInfo.certProviders());\n    }\n    throw new UnsupportedOperationException(\"Unsupported configurations in DownstreamTlsContext!\");\n  }\n}\n","sourceCodeStart":41,"sourceCodeEnd":62,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/internal/security/ServerSslContextProviderFactory.java#L41-L62","documentation":"ServerSslContextProviderFactory.create builds an SSL context provider from an xDS DownstreamTlsContext for servers. It only supports configurations it recognizes (e.g. certificate-provider-based common TlsContext handled by certProviderServerSslContextProviderFactory); anything else falls through the checks and hits an explicit UnsupportedOperationException. This is the library saying the DownstreamTlsContext combination is not implemented.","triggerScenarios":"Configuring a server with securityTlsContext/DownstreamTlsContext whose CommonTlsContext uses validation contexts or TLS material forms not handled by the factory (e.g. static file-based certs, combined validation contexts) instead of a supported cert provider config; create() then throws.","commonSituations":"Users converting from file-based Envoy TLS configs to grpc-java xDS; control planes emitting tls_context fields grpc-java does not implement; older/newer xDS API surfaces with unsupported validation_context_type combinations.","solutions":["Switch the DownstreamTlsContext to a certificate-provider-based CommonTlsContext (e.g. use the same plugin names configured in gRPC bootstrap certProviders)","Check grpc-java version/release notes for which DownstreamTlsContext forms are supported and upgrade if a newer version adds support","Fall back to non-xDS TLS (in-process server TLS setup) if the required config form is unsupported","Validate the DownstreamTlsContext proto before deploying so unsupported shapes are caught at config time"],"exampleFix":"// before: file-based validation context unsupported by grpc-java xDS\ndownstreamTlsContext.commonTlsContext.validationContextType = trusted_ca(file:...)\n// after: use certificate providers via bootstrap\ndownstreamTlsContext.commonTlsContext.tlsCertificateCertificateProviderInstance = {instance_name: \"google_cloud_private_spiffe\", certificate_name: \"spiffe://...\"}","handlingStrategy":"validation","validationCode":"// Check the DownstreamTlsContext shape before enabling xDS server security\nboolean supported(DownstreamTlsContext ctx) {\n  return ctx.hasCommonTlsContext()\n      && (ctx.getCommonTlsContext().getTlsCertificateCertificateProviderInstanceCase()\n             == CommonTlsContext.TlsCertificateCertificateProviderInstanceCase.CERTIFICATE_PROVIDER_INSTANCE);\n}\nif (!supported(downstreamTlsContext)) throw new IllegalArgumentException(\"unsupported DownstreamTlsContext\");","typeGuard":null,"tryCatchPattern":"try {\n  provider = serverSslContextProviderFactory.create(...);\n} catch (UnsupportedOperationException e) {\n  logger.error(\"xDS server TLS config unsupported; check DownstreamTlsContext form\", e);\n  throw new ConfigException(e);\n}","preventionTips":["Use certificate-provider-based CommonTlsContext for xDS TLS in grpc-java","Compare your config against grpc-java supported DownstreamTlsContext docs for your version","Pin grpc-java version and validate xDS security config in CI"],"tags":["xds","tls","security","grpc"],"backgroundTag":"unsupported-config-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}