{"record":{"id":"a700cabc5d21b835","repo":"grpc/grpc-java","slug":"unexpected-error-converting-servercredentials-to-n","errorCode":null,"errorMessage":"Unexpected error converting ServerCredentials to Netty SslContext","messagePattern":"Unexpected error converting ServerCredentials to Netty SslContext","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"netty/src/main/java/io/grpc/netty/ProtocolNegotiators.java","lineNumber":232,"sourceCode":"          break;\n\n        case REQUIRE:\n          builder.clientAuth(io.netty.handler.ssl.ClientAuth.REQUIRE);\n          break;\n\n        case NONE:\n          builder.clientAuth(io.netty.handler.ssl.ClientAuth.NONE);\n          break;\n\n        default:\n          return FromServerCredentialsResult.error(\n              \"Unknown TlsServerCredentials.ClientAuth value: \" + tlsCreds.getClientAuth());\n      }\n      SslContext sslContext;\n      try {\n        sslContext = builder.build();\n      } catch (SSLException ex) {\n        throw new IllegalArgumentException(\n            \"Unexpected error converting ServerCredentials to Netty SslContext\", ex);\n      }\n      return FromServerCredentialsResult.negotiator(serverTlsFactory(sslContext));\n\n    } else if (creds instanceof InsecureServerCredentials) {\n      return FromServerCredentialsResult.negotiator(serverPlaintextFactory());\n\n    } else if (creds instanceof NettyServerCredentials) {\n      NettyServerCredentials nettyCreds = (NettyServerCredentials) creds;\n      return FromServerCredentialsResult.negotiator(nettyCreds.getNegotiator());\n\n    } else if (creds instanceof ChoiceServerCredentials) {\n      ChoiceServerCredentials choiceCreds = (ChoiceServerCredentials) creds;\n      StringBuilder error = new StringBuilder();\n      for (ServerCredentials innerCreds : choiceCreds.getCredentialsList()) {\n        FromServerCredentialsResult result = from(innerCreds);\n        if (result.error == null) {\n          return result;","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/netty/src/main/java/io/grpc/netty/ProtocolNegotiators.java#L214-L250","documentation":"ProtocolNegotiators.from(ServerCredentials) converts TlsServerCredentials into a Netty SslContext. If SslContext builder.build() throws SSLException, it is rethrown as IllegalArgumentException with message \"Unexpected error converting ServerCredentials to Netty SslContext\" and the SSLException as cause. This surfaces TLS material problems at server-builder time.","triggerScenarios":"Calling NettyServerBuilder.forAddress(addr, tlsServerCredentials) (or forPort) where the TlsServerCredentials' key/cert managers cannot be turned into a valid SslContext: malformed key or certificate data, unsupported key format, or incompatible TLS provider configuration.","commonSituations":"TlsServerCredentials built with a bad private key or mismatched cert chain; keys in unsupported formats (e.g. encrypted PKCS#8 without a password supplier); missing/mismatched netty-tcnative so the default SslProvider fails; Conscrypt/JDK provider conflicts.","solutions":["Inspect the cause SSLException for the concrete TLS parsing failure.","Verify the private key and certificate chain match and are in a supported format (unencrypted PEM/PKCS#8).","Add or align netty-tcnative-boringssl-static (or Conscrypt) with your netty version, or force the JDK SslProvider.","Test the material locally: GrpcSslContexts.forServer(cert, key).build() in isolation to reproduce the failure."],"exampleFix":"// before\nTlsServerCredentials creds = TlsServerCredentials.newBuilder()\n    .keyManager(badCert, encryptedKey) // parse fails later as IAE\n    .build();\n// after\nTlsServerCredentials creds = TlsServerCredentials.newBuilder()\n    .keyManager(certX509, unencryptedPrivateKey) // validated PEM pair\n    .build();","handlingStrategy":"try-catch","validationCode":"try {\n  GrpcSslContexts.forServer(certFile, keyFile).build(); // pre-validate TlsServerCredentials material\n} catch (SSLException e) {\n  throw new IllegalArgumentException(\"Bad TLS material: \" + e.getMessage(), e);\n}","typeGuard":null,"tryCatchPattern":"try {\n  Server s = NettyServerBuilder.forAddress(addr, tlsCreds).build();\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().contains(\"converting ServerCredentials\")) {\n    // cause SSLException: fix key/cert material or SslProvider\n  }\n}","preventionTips":["Ensure key/cert are a matching, unencrypted PEM pair","Align netty-tcnative with netty version or use the JDK provider","Dry-run SslContext build at startup to fail fast"],"tags":["grpc","java","tls","ssl-context","server-credentials"],"backgroundTag":"invalid-argument-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}