{"record":{"id":"d861df8f6a43b728","repo":"grpc/grpc-java","slug":"tls-not-supported-in-binderserver","errorCode":null,"errorMessage":"TLS not supported in BinderServer","messagePattern":"TLS not supported in BinderServer","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"binder/src/main/java/io/grpc/binder/BinderServerBuilder.java","lineNumber":141,"sourceCode":"   * @return this\n   */\n  public BinderServerBuilder securityPolicy(ServerSecurityPolicy securityPolicy) {\n    internalBuilder.setServerSecurityPolicy(securityPolicy);\n    return this;\n  }\n\n  /** Sets the policy for inbound parcelable objects. */\n  @ExperimentalApi(\"https://github.com/grpc/grpc-java/issues/8022\")\n  public BinderServerBuilder inboundParcelablePolicy(\n      InboundParcelablePolicy inboundParcelablePolicy) {\n    internalBuilder.setInboundParcelablePolicy(inboundParcelablePolicy);\n    return this;\n  }\n\n  /** Always fails. TLS is not supported in BinderServer. */\n  @Override\n  public BinderServerBuilder useTransportSecurity(File certChain, File privateKey) {\n    throw new UnsupportedOperationException(\"TLS not supported in BinderServer\");\n  }\n\n  /**\n   * Builds a {@link Server} according to this builder's parameters and stores its listening {@link\n   * IBinder} in the {@link IBinderReceiver} passed to {@link #forAddress(AndroidComponentAddress,\n   * IBinderReceiver)}.\n   *\n   * @return the new Server\n   */\n  @Override\n  public Server build() {\n    // Since we install a final interceptor here, we need to ensure we're only built once.\n    checkState(!isBuilt, \"BinderServerBuilder can only be used to build one server instance.\");\n    isBuilt = true;\n    // We install the security interceptor last, so it's closest to the transport.\n    BinderTransportSecurity.installAuthInterceptor(this);\n    internalBuilder.setExecutorPool(serverImplBuilder.getExecutorPool());\n    return super.build();","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/binder/src/main/java/io/grpc/binder/BinderServerBuilder.java#L123-L159","documentation":"BinderServerBuilder.useTransportSecurity(File certChain, File privateKey) overrides the ServerBuilder TLS setup but the binder transport does not support TLS — it communicates over Android Binder IPC, where transport security is provided by the OS process boundary. The method always throws UnsupportedOperationException('TLS not supported in BinderServer').","triggerScenarios":"Calling useTransportSecurity(certChain, privateKey) (or the File-less overload) on a BinderServerBuilder before build().","commonSituations":"Copy-pasted server setup that enables TLS for every ServerBuilder; attempting to 'harden' a binder server with TLS out of habit from INET servers.","solutions":["Remove the useTransportSecurity call — Binder IPC is already protected by the Android process sandbox","If TLS is a hard requirement, run the server over the standard NettyServerBuilder instead of the binder transport"],"exampleFix":"// before\nBinderServerBuilder.forAddress(addr, receiver)\n    .useTransportSecurity(new File(\"cert.pem\"), new File(\"key.pem\"))\n    .build();\n// after\nBinderServerBuilder.forAddress(addr, receiver).build();","handlingStrategy":"validation","validationCode":"if (tlsEnabled && serverBuilder instanceof BinderServerBuilder) {\n  throw new IllegalArgumentException(\"TLS is not supported for binder servers\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  return builder.build();\n} catch (UnsupportedOperationException e) {\n  if (e.getMessage().contains(\"TLS\")) { log.warn(\"TLS unsupported on binder transport; using Binder IPC security\"); }\n  throw e;\n}","preventionTips":["Never configure useTransportSecurity on BinderServerBuilder","Rely on Android IPC security (permissions, signatures) for binder transport","Choose NettyServerBuilder when TLS termination is a requirement"],"tags":["grpc","binder","android","tls","unsupported-operation"],"backgroundTag":"unsupported-operation","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}