{"record":{"id":"88a0e31581f2938f","repo":"grpc/grpc-java","slug":"downstream-tls-context-with-ocsp-staple-policy-val","errorCode":null,"errorMessage":"downstream-tls-context with ocsp_staple_policy value ${ocspStaplePolicy.name()} is not supported","messagePattern":"downstream-tls-context with ocsp_staple_policy value (.+?) is not supported","errorType":"exception","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/XdsListenerResource.java","lineNumber":314,"sourceCode":"  static DownstreamTlsContext validateDownstreamTlsContext(\n      DownstreamTlsContext downstreamTlsContext, Set<String> certProviderInstances)\n      throws ResourceInvalidException {\n    if (downstreamTlsContext.hasCommonTlsContext()) {\n      validateCommonTlsContext(downstreamTlsContext.getCommonTlsContext(), certProviderInstances,\n          true);\n    } else {\n      throw new ResourceInvalidException(\n          \"common-tls-context is required in downstream-tls-context\");\n    }\n    if (downstreamTlsContext.hasRequireSni()) {\n      throw new ResourceInvalidException(\n          \"downstream-tls-context with require-sni is not supported\");\n    }\n    DownstreamTlsContext.OcspStaplePolicy ocspStaplePolicy = downstreamTlsContext\n        .getOcspStaplePolicy();\n    if (ocspStaplePolicy != DownstreamTlsContext.OcspStaplePolicy.UNRECOGNIZED\n        && ocspStaplePolicy != DownstreamTlsContext.OcspStaplePolicy.LENIENT_STAPLING) {\n      throw new ResourceInvalidException(\n          \"downstream-tls-context with ocsp_staple_policy value \" + ocspStaplePolicy.name()\n              + \" is not supported\");\n    }\n    return downstreamTlsContext;\n  }\n\n  private static void validateFilterChainMatchForUniqueness(\n      Set<FilterChainMatch> filterChainMatchSet,\n      FilterChainMatch filterChainMatch) throws ResourceInvalidException {\n    // Flattens complex FilterChainMatch into a list of simple FilterChainMatch'es.\n    List<FilterChainMatch> crossProduct = getCrossProduct(filterChainMatch);\n    for (FilterChainMatch cur : crossProduct) {\n      if (!filterChainMatchSet.add(cur)) {\n        throw new ResourceInvalidException(\"FilterChainMatch must be unique. \"\n            + \"Found duplicate: \" + cur);\n      }\n    }\n  }","sourceCodeStart":296,"sourceCodeEnd":332,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/XdsListenerResource.java#L296-L332","documentation":"gRPC xDS supports only LENIENT_STAPLING (or unset) for the ocsp_staple_policy field of a downstream TLS context. Any other OCSP staple policy value (e.g. STRICT_STAPLING, PERMIT_NO_STAPLING) makes the Listener resource invalid, so XdsListenerResource.validateDownstreamTlsContext throws a ResourceInvalidException and the Listener is rejected (NACKed).","triggerScenarios":"An xDS Listener proto whose filter_chain's downstream_tls_context has ocsp_staple_policy set to STRICT_STAPLING or PERMIT_NO_STAPLING, encountered while parsing filter chains via parseFilterChain -> validateDownstreamTlsContext.","commonSituations":"Envoy config generated with OCSP stapling enforcement enabled (control planes that copy Envoy defaults), security-hardened templates requiring strict stapling, or hand-written bootstrap YAML that sets ocsp_staple_policy for compliance reasons.","solutions":["Set ocsp_staple_policy to LENIENT_STAPLING in the downstream_tls_context, or remove the field entirely so it defaults to unset.","If strict OCSP stapling is a hard requirement, do not use gRPC xDS for that listener; terminate TLS at Envoy instead of the gRPC client/server.","Check the control plane that generates the Listener resource and remove or adjust the ocsp_staple_policy override."],"exampleFix":"// before (Envoy Listener v3 YAML)\ndownstream_tls_context:\n  common_tls_context: ...\n  ocsp_staple_policy: STRICT_STAPLING\n// after\ndownstream_tls_context:\n  common_tls_context: ...\n  ocsp_staple_policy: LENIENT_STAPLING","handlingStrategy":"validation","validationCode":"// before submitting the Listener resource\nif (hcm.hasDownstreamTlsContext()\n    && hcm.getDownstreamTlsContext().getOcspStaplePolicy() != UNSET\n    && hcm.getDownstreamTlsContext().getOcspStaplePolicy() != LENIENT_STAPLING) {\n  throw new IllegalArgumentException(\"ocsp_staple_policy must be LENIENT_STAPLING or unset\");\n}","typeGuard":null,"tryCatchPattern":"// xDS clients surface this via Listener error/nack status\nlistenerWatcher.onError(status); // inspect Status detail for \"ocsp_staple_policy value ... is not supported\"","preventionTips":["Never set ocsp_staple_policy in resources consumed by gRPC xDS","Validate Listener protos against gRPC's supported subset before publishing from the control plane","Pin Envoy templates separately for Envoy-consumed vs gRPC-consumed listeners"],"tags":["grpc","xds","tls","config-validation"],"backgroundTag":"unsupported-config-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}