{"record":{"id":"78555b530c6f9186","repo":"grpc/grpc-go","slug":"xds-fetching-trusted-roots-from-certificateprovid","errorCode":null,"errorMessage":"xds: fetching trusted roots from CertificateProvider failed: %v","messagePattern":"xds: fetching trusted roots from CertificateProvider failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/credentials/xds/handshake_info.go","lineNumber":224,"sourceCode":"\t// On the client side, rootProvider is mandatory. IdentityProvider is\n\t// optional based on whether the client is doing TLS or mTLS.\n\tif hi.rootProvider == nil {\n\t\treturn nil, errors.New(\"xds: CertificateProvider to fetch trusted roots is missing, cannot perform TLS handshake. Please check configuration on the management server\")\n\t}\n\n\t// InsecureSkipVerify needs to be set to true because we need to perform\n\t// custom verification to check the SAN on the received certificate.\n\t// Currently the Go stdlib does complete verification of the cert (which\n\t// includes hostname verification) or none. We are forced to go with the\n\t// latter and perform the normal cert validation ourselves.\n\tcfg := &tls.Config{\n\t\tInsecureSkipVerify: true,\n\t\tNextProtos:         []string{\"h2\"},\n\t}\n\n\tkm, err := hi.rootProvider.KeyMaterial(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"xds: fetching trusted roots from CertificateProvider failed: %v\", err)\n\t}\n\tcfg.RootCAs = km.Roots\n\n\t// If AutoHostSNI is true, and the endpoint hostname is present, we use the\n\t// endpoint hostname as the SNI value and also for SAN validation.\n\t// Otherwise, we use the SNI value from HandshakeInfo (which is configured\n\t// by the control plane) and validating SANs based on that.\n\tsni := hi.sni\n\tif hi.useAutoHostSNI && hostname != \"\" {\n\t\tsni = hostname\n\t}\n\n\tcfg.VerifyPeerCertificate = hi.buildVerifyFunc(km, true, sni)\n\n\tif hi.identityProvider != nil {\n\t\tkm, err := hi.identityProvider.KeyMaterial(ctx)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"xds: fetching identity certificates from CertificateProvider failed: %v\", err)","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/credentials/xds/handshake_info.go#L206-L242","documentation":"Returned by the client-side TLS config builder when the root CertificateProvider's KeyMaterial call fails. On the client side a root provider is mandatory for verifying the server, so any failure to obtain trusted roots aborts the handshake setup. The wrapped error comes from the configured certprovider.Provider (e.g. filesystem, xDS).","triggerScenarios":"Calling ClientSideTLSConfig -> clientSideTLSConfigInternal where hi.rootProvider.KeyMaterial(ctx) returns an error. Typical providers: certprovider.NewFileWatcherProvider with a missing/corrupt CA file, or an xDS-based provider whose certificate distribution has not completed.","commonSituations":"Misconfigured CertificateProvider plugin on the xDS management server; CA file path wrong or unreadable in the container; filesystem watcher hitting a rotated-away file; xDS resources not yet pushed so the provider has no material.","solutions":["Check the management server pushed the CertificateProvider resources (root cert) for this listener/cluster.","Verify file paths and permissions for any file-based certprovider mount.","Ensure the certprovider plugin is loaded and registered before the gRPC channel starts.","Wait for the provider to become ready (it surfaces KeyMaterial errors until the first update arrives) or restart after config propagation."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"cfg, fallback, done, err := xds.ClientSideTLSConfig(ctx, hi, host)\nif err != nil {\n    if strings.Contains(err.Error(), \"fetching trusted roots\") {\n        // back off; the certprovider likely has no material yet — retry after xDS update\n    }\n}","preventionTips":["Delay channel start until the certprovider reports it has key material.","Monitor certprovider KeyMaterial errors and alert before they affect handshakes.","Validate file-based provider paths at process startup."],"tags":["grpc","xds","mtls","cert-provider","handshake","client"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}