{"record":{"id":"bf984cf18c56a371","repo":"grpc/grpc-go","slug":"security-configuration-on-the-server-side-does-not","errorCode":null,"errorMessage":"security configuration on the server-side does not contain identity certificate provider instance name","messagePattern":"security configuration on the server-side does not contain identity certificate provider instance name","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/xdsclient/xdsresource/unmarshal_cds.go","lineNumber":414,"sourceCode":"\n\t// For now, if we can't get a valid security config from the new fields, we\n\t// fallback to the old deprecated fields.\n\t// TODO: Drop support for deprecated fields. NACK if err != nil here.\n\tsc, err1 := securityConfigFromCommonTLSContextUsingNewFields(common, server)\n\tif sc == nil || sc.Equal(&SecurityConfig{}) {\n\t\tvar err error\n\t\tsc, err = securityConfigFromCommonTLSContextWithDeprecatedFields(common, server)\n\t\tif err != nil {\n\t\t\t// Retain the validation error from using the new fields.\n\t\t\treturn nil, errors.Join(err1, fmt.Errorf(\"failed to parse config using deprecated fields: %v\", err))\n\t\t}\n\t}\n\tif sc != nil {\n\t\t// sc == nil is a valid case where the control plane has not sent us any\n\t\t// security configuration. xDS creds will use fallback creds.\n\t\tif server {\n\t\t\tif sc.IdentityInstanceName == \"\" {\n\t\t\t\treturn nil, errors.New(\"security configuration on the server-side does not contain identity certificate provider instance name\")\n\t\t\t}\n\t\t} else {\n\t\t\tif !sc.UseSystemRootCerts && sc.RootInstanceName == \"\" {\n\t\t\t\treturn nil, errors.New(\"security configuration on the client-side does not contain root certificate provider instance name\")\n\t\t\t}\n\t\t}\n\t}\n\treturn sc, nil\n}\n\nfunc securityConfigFromCommonTLSContextWithDeprecatedFields(common *v3tlspb.CommonTlsContext, server bool) (*SecurityConfig, error) {\n\t// The `CommonTlsContext` contains a\n\t// `tls_certificate_certificate_provider_instance` field of type\n\t// `CertificateProviderInstance`, which contains the provider instance name\n\t// and the certificate name to fetch identity certs.\n\tsc := &SecurityConfig{}\n\tif identity := common.GetTlsCertificateCertificateProviderInstance(); identity != nil {\n\t\tsc.IdentityInstanceName = identity.GetInstanceName()","sourceCodeStart":396,"sourceCodeEnd":432,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/xdsclient/xdsresource/unmarshal_cds.go#L396-L432","documentation":"Returned by securityConfigFromCommonTLSContext (unmarshal_cds.go:413-414) for a server-side security config when IdentityInstanceName is empty. The identity (server) certificate is mandatory for serving TLS, so a security block without an identity cert provider instance name is invalid. The server flag branch (server==true) enforces this after both new and deprecated field parsing.","triggerScenarios":"A CommonTlsContext for the server side (DownstreamTlsContext, or the shared security parser invoked with server=true) that yields a non-nil SecurityConfig but with IdentityInstanceName==\"\". This happens when no tls_certificate certificate-provider-instance or legacy tls_certificates field is set.","commonSituations":"Control plane configures a downstream TLS context with a validation context (root) but forgets the identity/server cert provider; misnamed instance; bootstrap certificate provider not registered.","solutions":["Populate the identity certificate provider instance (tls_certificate_certificate_provider_instance.instance_name) in the CommonTlsContext for the server.","Ensure the matching certificate provider is registered in the gRPC bootstrap so the instance name resolves.","If TLS should be disabled on that listener, remove the DownstreamTlsContext/transport_socket so sc stays nil."],"exampleFix":"// before\n//   common_tls_context: { validation_context: { ... } }   // no identity\n// after\n//   common_tls_context: {\n//     tls_certificate_certificate_provider_instance: { instance_name: \"default\", certificate_name: \"server\" },\n//     validation_context: { ... }\n//   }","handlingStrategy":"validation","validationCode":"func serverSecurityHasIdentity(sc *SecurityConfig) bool {\n    return sc != nil && sc.IdentityInstanceName != \"\"\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set a tls_certificate_certificate_provider_instance for server-side TLS configs.","Ensure the identity provider instance name exists in the gRPC bootstrap.","Omit the security block entirely if TLS is not required."],"tags":["xds","tls","mtls","security","config","server"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}