{"record":{"id":"cc10603ea274f6a4","repo":"grpc/grpc-go","slug":"security-configuration-on-the-server-side-does-not-cc1060","errorCode":null,"errorMessage":"security configuration on the server-side does not contain root certificate provider instance name, but require_client_cert field is set","messagePattern":"security configuration on the server-side does not contain root certificate provider instance name, but require_client_cert field is set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/xds/xdsclient/xdsresource/unmarshal_lds.go","lineNumber":363,"sourceCode":"\t\treturn emptyFilterChain, fmt.Errorf(\"failed to unmarshal DownstreamTlsContext in LDS response: %v\", err)\n\t}\n\tif downstreamCtx.GetRequireSni().GetValue() {\n\t\treturn emptyFilterChain, fmt.Errorf(\"require_sni field set to true in DownstreamTlsContext message: %v\", downstreamCtx)\n\t}\n\tif downstreamCtx.GetOcspStaplePolicy() != v3tlspb.DownstreamTlsContext_LENIENT_STAPLING {\n\t\treturn emptyFilterChain, fmt.Errorf(\"ocsp_staple_policy field set to unsupported value in DownstreamTlsContext message: %v\", downstreamCtx)\n\t}\n\tif downstreamCtx.GetCommonTlsContext() == nil {\n\t\treturn emptyFilterChain, errors.New(\"DownstreamTlsContext in LDS response does not contain a CommonTlsContext\")\n\t}\n\tsc, err := securityConfigFromCommonTLSContext(downstreamCtx.GetCommonTlsContext(), true)\n\tif err != nil {\n\t\treturn emptyFilterChain, err\n\t}\n\tif sc != nil {\n\t\tsc.RequireClientCert = downstreamCtx.GetRequireClientCertificate().GetValue()\n\t\tif sc.RequireClientCert && sc.RootInstanceName == \"\" {\n\t\t\treturn emptyFilterChain, errors.New(\"security configuration on the server-side does not contain root certificate provider instance name, but require_client_cert field is set\")\n\t\t}\n\t\tfcc.SecurityCfg = sc\n\t}\n\treturn fcc, nil\n}\n\n// dstPrefixEntry wraps DestinationPrefixEntry to track build state.\ntype dstPrefixEntry struct {\n\tentry         DestinationPrefixEntry\n\trawBufferSeen bool\n}\n\nfunc buildFilterChainMap(fcs []*v3listenerpb.FilterChain) (NetworkFilterChainMap, error) {\n\tdstPrefixEntries := []*dstPrefixEntry{}\n\tfor _, fc := range fcs {\n\t\tfcMatch := fc.GetFilterChainMatch()\n\t\tif fcMatch.GetDestinationPort().GetValue() != 0 {\n\t\t\t// Destination port is the first match criteria and we do not","sourceCodeStart":345,"sourceCodeEnd":381,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/internal/xds/xdsclient/xdsresource/unmarshal_lds.go#L345-L381","documentation":"Returned by the downstream filter-chain security parser (unmarshal_lds.go:362-363) when the DownstreamTlsContext requires client certificates (require_client_certificate=true) but the resulting server-side SecurityConfig has no root certificate provider instance name. Mutual TLS requires a root/CA trust store to validate client certs, so requiring client auth without a root provider is contradictory and rejected.","triggerScenarios":"An LDS filter chain sets DownstreamTlsContext.require_client_certificate=true but the CommonTlsContext lacks a validation_context / certificate_provider_instance for root certs. After securityConfigFromCommonTLSContext returns sc, the code sets RequireClientCert and checks RootInstanceName==\"\" at line 362.","commonSituations":"Control plane enables require_client_certificate but forgets the validation_context; a config edit that removed the root provider while keeping mTLS on; bootstrap missing the root cert provider.","solutions":["Add a validation_context.certificate_provider_instance.instance_name (root cert provider) to the server CommonTlsContext so client certs can be validated.","If client-cert auth is not actually required, set require_client_certificate to false.","Verify the root cert provider referenced is registered in bootstrap and provides a CA bundle."],"exampleFix":"// before\n//   downstream_tls_context: {\n//     common_tls_context: { tls_certificate_certificate_provider_instance: {...} },\n//     require_client_certificate: true            // no validation_context\n//   }\n// after\n//   downstream_tls_context: {\n//     common_tls_context: {\n//       tls_certificate_certificate_provider_instance: {...},\n//       validation_context: { certificate_provider_instance: { instance_name: \"default\", certificate_name: \"ca\" } }\n//     },\n//     require_client_certificate: true\n//   }","handlingStrategy":"validation","validationCode":"func mTLSServerHasRoots(sc *SecurityConfig) bool {\n    if sc == nil { return true } // no security block\n    if !sc.RequireClientCert { return true }\n    return sc.RootInstanceName != \"\"\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Whenever require_client_certificate is true, set a validation_context root provider.","If client cert auth is optional, set require_client_certificate to false instead.","Cross-check the root provider instance name against bootstrap before rollout."],"tags":["xds","lds","tls","mtls","security","config","server"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}