{"record":{"id":"8c9faccb88e14f52","repo":"grpc/grpc-java","slug":"can-t-set-tls-settings-for-alts","errorCode":null,"errorMessage":"Can't set TLS settings for ALTS","messagePattern":"Can't set TLS settings for ALTS","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"alts/src/main/java/io/grpc/alts/AltsServerBuilder.java","lineNumber":136,"sourceCode":"\n  /** {@inheritDoc} */\n  @Override\n  public AltsServerBuilder addService(BindableService bindableService) {\n    delegate.addService(bindableService);\n    return this;\n  }\n\n  /** {@inheritDoc} */\n  @Override\n  public AltsServerBuilder fallbackHandlerRegistry(HandlerRegistry fallbackRegistry) {\n    delegate.fallbackHandlerRegistry(fallbackRegistry);\n    return this;\n  }\n\n  /** {@inheritDoc} */\n  @Override\n  public AltsServerBuilder useTransportSecurity(File certChain, File privateKey) {\n    throw new UnsupportedOperationException(\"Can't set TLS settings for ALTS\");\n  }\n\n  /** {@inheritDoc} */\n  @Override\n  public AltsServerBuilder decompressorRegistry(DecompressorRegistry registry) {\n    delegate.decompressorRegistry(registry);\n    return this;\n  }\n\n  /** {@inheritDoc} */\n  @Override\n  public AltsServerBuilder compressorRegistry(CompressorRegistry registry) {\n    delegate.compressorRegistry(registry);\n    return this;\n  }\n\n  /** {@inheritDoc} */\n  @Override","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/alts/src/main/java/io/grpc/alts/AltsServerBuilder.java#L118-L154","documentation":"AltsServerBuilder deliberately does not support configuring TLS via useTransportSecurity(), because ALTS provides its own transport security layer. Any attempt to set TLS certs on an ALTS server throws UnsupportedOperationException at build time.","triggerScenarios":"Calling useTransportSecurity(certChain, privateKey) on an AltsServerBuilder instance, typically by copy-pasting builder code written for NettyServerBuilder.","commonSituations":"Migrating a Netty server to ALTS while leaving the TLS configuration lines in place; or shared builder-factory code that configures TLS for all server types.","solutions":["Remove the useTransportSecurity() call — ALTS negotiates its own channel encryption","If TLS is genuinely required, use NettyServerBuilder/GrpcSslContexts instead of AltsServerBuilder","Keep a single builder code path and branch on the transport type instead of calling transport-specific methods"],"exampleFix":"// before\nAltsServerBuilder.forPort(port).useTransportSecurity(cert, key).addService(svc).build();\n// after\nAltsServerBuilder.forPort(port).addService(svc).build(); // ALTS handles transport security","handlingStrategy":"validation","validationCode":"if (builder instanceof AltsServerBuilder) {\n  throw new IllegalStateException(\"Do not configure TLS; ALTS provides transport security\");\n}","typeGuard":"null","tryCatchPattern":"try {\n  builder.useTransportSecurity(cert, key);\n} catch (UnsupportedOperationException e) {\n  // ALTS builder: skip TLS config; switch to NettyServerBuilder if TLS is required\n}","preventionTips":["Never copy TLS-config code into ALTS builder chains","Abstract server construction so TLS options only apply to TLS-capable builders","Remember ALTS already encrypts the transport"],"tags":["grpc","alts","java","tls","unsupported-operation"],"backgroundTag":"unsupported-operation","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}