{"record":{"id":"9cb83e8077943ae8","repo":"grpc/grpc-java","slug":"checkservertrustedmethod-not-found","errorCode":null,"errorMessage":"checkServerTrustedMethod not found","messagePattern":"checkServerTrustedMethod not found","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"netty/src/main/java/io/grpc/netty/X509AuthorityVerifier.java","lineNumber":103,"sourceCode":"    if (portNumberSeperatorColonIndex > closingSquareBracketIndex) {\n      return authority.substring(0, portNumberSeperatorColonIndex);\n    }\n    return authority;\n  }\n\n  private void verifyAuthorityAllowedForPeerCert(String authority)\n          throws SSLPeerUnverifiedException, CertificateException, InvocationTargetException,\n          IllegalAccessException {\n    SSLEngine sslEngineWrapper = new ProtocolNegotiators.SslEngineWrapper(sslEngine, authority);\n    // The typecasting of Certificate to X509Certificate should work because this method will only\n    // be called when using TLS and thus X509.\n    Certificate[] peerCertificates = sslEngine.getSession().getPeerCertificates();\n    X509Certificate[] x509PeerCertificates = new X509Certificate[peerCertificates.length];\n    for (int i = 0; i < peerCertificates.length; i++) {\n      x509PeerCertificates[i] = (X509Certificate) peerCertificates[i];\n    }\n    if (checkServerTrustedMethod == null) {\n      throw new IllegalStateException(\"checkServerTrustedMethod not found\");\n    }\n    checkServerTrustedMethod.invoke(\n            x509ExtendedTrustManager, x509PeerCertificates, \"UNKNOWN\", sslEngineWrapper);\n  }\n}\n","sourceCodeStart":85,"sourceCodeEnd":109,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/netty/src/main/java/io/grpc/netty/X509AuthorityVerifier.java#L85-L109","documentation":"X509AuthorityVerifier verifies that the certificate authority presented by the peer is acceptable by reflectively invoking checkServerTrusted(X509Certificate[], String, SSLEngine) on an X509ExtendedTrustManager. If that method handle was never resolved (null), an IllegalStateException is thrown before invocation. This is an internal invariant: the trust manager should have provided the method during initialization.","triggerScenarios":"verifyAuthority -> verifyAuthorityAllowedForPeerCert runs during a TLS handshake with custom trust managers when the reflective lookup of checkServerTrusted failed at class init (unusual JVM, non-standard X509ExtendedTrustManager, or overridden security provider).","commonSituations":"Custom security providers or FIPS JVMs where X509ExtendedTrustManager resolution differs; instrumentation/agents interfering with reflection; running on a JVM where the assumed trust-manager API surface isn't present.","solutions":["Use a standard JDK/Conscrypt trust manager setup and a supported JVM version (JDK 8+)","Check how checkServerTrustedMethod is resolved in X509AuthorityVerifier and ensure the default TrustManagerFactory (not a bare X509TrustManager) supplies the extended trust manager","Upgrade grpc-netty to a version with fixes to X509 authority verification","Remove conflicting security providers/agents that hide X509ExtendedTrustManager"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  channel = builder.build();\n} catch (IllegalStateException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"checkServerTrustedMethod not found\")) {\n    throw new IllegalStateException(\"TLS trust-manager reflection unsupported on this JVM/provider: \" + e, e);\n  }\n  throw e;\n}","preventionTips":["Run on a mainstream supported JDK with default or Conscrypt providers","Avoid custom X509ExtendedTrustManager providers unless tested against grpc-netty's verifier","Keep grpc-netty updated for TLS verification fixes","Test mutual TLS / custom CA setups in CI on the target JVM"],"tags":["tls","x509","reflection","grpc","handshake"],"backgroundTag":"internal-invariant-violation","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}