{"record":{"id":"7972c8848715771e","repo":"grpc/grpc-java","slug":"could-not-find-jetty-npn-alpn-or-conscrypt-as-inst","errorCode":null,"errorMessage":"Could not find Jetty NPN/ALPN or Conscrypt as installed JDK providers","messagePattern":"Could not find Jetty NPN/ALPN or Conscrypt as installed JDK providers","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"netty/src/main/java/io/grpc/netty/GrpcSslContexts.java","lineNumber":169,"sourceCode":"   */\n  @CanIgnoreReturnValue\n  public static SslContextBuilder configure(SslContextBuilder builder) {\n    return configure(builder, defaultSslProvider());\n  }\n\n  /**\n   * Set ciphers and APN appropriate for gRPC. Precisely what is set is permitted to change, so if\n   * an application requires particular settings it should override the options set here. For\n   * client builders, HTTPS endpoint identification is enabled by default.\n   */\n  @ExperimentalApi(\"https://github.com/grpc/grpc-java/issues/1784\")\n  @CanIgnoreReturnValue\n  public static SslContextBuilder configure(SslContextBuilder builder, SslProvider provider) {\n    switch (provider) {\n      case JDK: {\n        Provider jdkProvider = findJdkProvider();\n        if (jdkProvider == null) {\n          throw new IllegalArgumentException(\n              \"Could not find Jetty NPN/ALPN or Conscrypt as installed JDK providers\");\n        }\n        return configure(builder, jdkProvider);\n      }\n      case OPENSSL: {\n        ApplicationProtocolConfig apc;\n        if (OpenSsl.isAlpnSupported()) {\n          apc = NPN_AND_ALPN;\n        } else {\n          apc = NPN;\n        }\n        return builder\n            .sslProvider(SslProvider.OPENSSL)\n            .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE)\n            .applicationProtocolConfig(apc)\n            .endpointIdentificationAlgorithm(DEFAULT_ENDPOINT_IDENTIFICATION_ALGORITHM);\n      }\n      default:","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/netty/src/main/java/io/grpc/netty/GrpcSslContexts.java#L151-L187","documentation":"GrpcSslContexts.configure() with SslProvider.JDK requires a JDK-level TLS provider that supports ALPN (Jetty NPN/ALPN, Conscrypt, or Java 9+ providers). If findJdkProvider() finds none, this IllegalArgumentException is thrown because gRPC over HTTP/2 cannot negotiate protocols.","triggerScenarios":"Calling GrpcSslContexts.configure(SslContextBuilder, SslProvider.JDK) (directly or via defaultSslProvider resolution) on a JVM with no ALPN-capable SSL provider registered.","commonSituations":"Running on Java 8 without the Jetty ALPN boot classpath agent or Conscrypt; using a JDK whose SSLContext.TLS providers lack ALPN support; explicitly forcing SslProvider.JDK when only OpenSSL would work.","solutions":["Add Conscrypt to the classpath and register it as a security provider","On Java 8, install the Jetty ALPN boot jar/agent matching the JDK version","Use SslProvider.OPENSSL with netty-tcnative instead of JDK","Run on Java 9+ where ALPN is built in"],"exampleFix":"// before\nGrpcSslContexts.configure(SslContextBuilder.forClient(), SslProvider.JDK);\n// after\nSecurity.insertProviderAt(new OpenSSLProvider(), 1); // or add conscrypt-openjdk to deps\nGrpcSslContexts.configure(SslContextBuilder.forClient(), SslProvider.OPENSSL);","handlingStrategy":"validation","validationCode":"if (JettyTlsUtil.getJettyAlpnUnavailabilityCause() != null && ConscryptHolder.UNAVAILABILITY_CAUSE != null && OpenSsl.isAvailable() == false) { /* no ALPN-capable provider */ }","typeGuard":"boolean hasAlpnProvider() { return GrpcSslContexts.class != null && (JettyTlsUtil.isJava9AlphAvailable() || isConscryptPresent() || OpenSsl.isAvailable()); }","tryCatchPattern":"try { GrpcSslContexts.configure(b, SslProvider.JDK); } catch (IllegalArgumentException e) { return GrpcSslContexts.configure(b, SslProvider.OPENSSL); }","preventionTips":["Pin Conscrypt or netty-tcnative in production dependencies","Verify ALPN availability at startup with a smoke test","On Java 8 always install the matching Jetty ALPN boot jar"],"tags":["grpc","tls","alpn","jdk","netty"],"backgroundTag":"missing-optional-dependency","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}