{"record":{"id":"ae7f23ad894c7365","repo":"grpc/grpc-java","slug":"failed-to-build-ssl-context-from-certificate-strea","errorCode":null,"errorMessage":"Failed to build SSL context from certificate streams: ${e}","messagePattern":"Failed to build SSL context from certificate streams: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"netty/src/main/java/io/grpc/netty/NettyServerBuilder.java","lineNumber":839,"sourceCode":"    } catch (SSLException e) {\n      // This should likely be some other, easier to catch exception.\n      throw new RuntimeException(e);\n    }\n    protocolNegotiatorFactory = ProtocolNegotiators.serverTlsFactory(sslContext);\n    return this;\n  }\n\n  @CanIgnoreReturnValue\n  @Override\n  public NettyServerBuilder useTransportSecurity(InputStream certChain, InputStream privateKey) {\n    checkState(!freezeProtocolNegotiatorFactory,\n               \"Cannot change security when using ServerCredentials\");\n    SslContext sslContext;\n    try {\n      sslContext = GrpcSslContexts.forServer(certChain, privateKey).build();\n    } catch (SSLException e) {\n      // This should likely be some other, easier to catch exception.\n      throw new RuntimeException(e);\n    }\n    protocolNegotiatorFactory = ProtocolNegotiators.serverTlsFactory(sslContext);\n    return this;\n  }\n}\n","sourceCodeStart":821,"sourceCodeEnd":845,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/netty/src/main/java/io/grpc/netty/NettyServerBuilder.java#L821-L845","documentation":"The InputStream overload of useTransportSecurity(certChain, privateKey) builds a server SslContext with GrpcSslContexts.forServer(certChain, privateKey).build(). SSLException from that build is wrapped in a RuntimeException with message \"Failed to build SSL context from certificate streams\" (original SSLException as cause).","triggerScenarios":"Calling useTransportSecurity(InputStream, InputStream) with streams whose contents are not a valid PEM X.509 cert chain plus unencrypted PEM private key — empty streams, wrong formats, encrypted keys, or streams already consumed (positioned at EOF).","commonSituations":"Loading cert material from the classpath where the resource was missing/empty; passing an encrypted key without a password; reusing an InputStream already read by another component; DER-encoded material passed as PEM.","solutions":["Inspect the cause SSLException for the exact parsing error.","Ensure streams are fresh (not yet consumed) and contain PEM data; reopen resources per call.","Decrypt password-protected keys beforehand or supply unencrypted PEM keys.","Validate material offline with `openssl x509 -in cert.pem` and `openssl pkey -in key.pem` before shipping."],"exampleFix":"// before\nInputStream cert = getClass().getResourceAsStream(\"/certs/server.crt\"); // may be null/empty\nserverBuilder.useTransportSecurity(cert, key);\n// after\ntry (InputStream cert = requireNonNull(getClass().getResourceAsStream(\"/certs/server.pem\"));\n     InputStream key = requireNonNull(getClass().getResourceAsStream(\"/certs/server-key.pem\"))) {\n  serverBuilder.useTransportSecurity(cert, key);\n}","handlingStrategy":"validation","validationCode":"byte[] certBytes = readAll(certStream); // stream must not be consumed/empty\nif (certBytes.length == 0) throw new IllegalArgumentException(\"empty cert chain stream\");\nif (!new String(certBytes, UTF_8).startsWith(\"-----BEGIN CERTIFICATE\")) throw new IllegalArgumentException(\"not PEM\");","typeGuard":null,"tryCatchPattern":"try {\n  serverBuilder.useTransportSecurity(certStream, keyStream);\n} catch (RuntimeException e) {\n  if (e.getCause() instanceof SSLException) {\n    // reopen fresh streams and verify PEM contents\n  }\n}","preventionTips":["Always pass freshly opened streams at position 0","Decrypt password-protected keys ahead of time","Verify resource paths exist on the classpath before shipping"],"tags":["grpc","java","tls","ssl-context","certificates"],"backgroundTag":"file-read-failed","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}