{"record":{"id":"ea31925655734906","repo":"grpc/grpc-java","slug":"unsupported-provider-provider","errorCode":null,"errorMessage":"Unsupported provider: ${provider}","messagePattern":"Unsupported provider: (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"netty/src/main/java/io/grpc/netty/GrpcSslContexts.java","lineNumber":188,"sourceCode":"              \"Could not find Jetty NPN/ALPN or Conscrypt as installed JDK providers\");\n        }\n        return configure(builder, jdkProvider);\n      }\n      case OPENSSL: {\n        ApplicationProtocolConfig apc;\n        if (OpenSsl.isAlpnSupported()) {\n          apc = NPN_AND_ALPN;\n        } else {\n          apc = NPN;\n        }\n        return builder\n            .sslProvider(SslProvider.OPENSSL)\n            .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE)\n            .applicationProtocolConfig(apc)\n            .endpointIdentificationAlgorithm(DEFAULT_ENDPOINT_IDENTIFICATION_ALGORITHM);\n      }\n      default:\n        throw new IllegalArgumentException(\"Unsupported provider: \" + provider);\n    }\n  }\n\n  /**\n   * Set ciphers and APN appropriate for gRPC. Precisely what is set is permitted to change, so if\n   * an application requires particular settings it should override the options set here. For\n   * client builders, HTTPS endpoint identification is enabled by default.\n   */\n  @CanIgnoreReturnValue\n  public static SslContextBuilder configure(SslContextBuilder builder, Provider jdkProvider) {\n    ApplicationProtocolConfig apc;\n    if (SUN_PROVIDER_NAME.equals(jdkProvider.getName())) {\n      // Jetty ALPN/NPN only supports one of NPN or ALPN\n      if (JettyTlsUtil.isJettyAlpnConfigured()) {\n        apc = ALPN;\n      } else if (JettyTlsUtil.isJettyNpnConfigured()) {\n        apc = NPN;\n      } else if (JettyTlsUtil.isJava9AlpnAvailable()) {","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/netty/src/main/java/io/grpc/netty/GrpcSslContexts.java#L170-L206","documentation":"The provider switch in GrpcSslContexts.configure() only handles JDK and OPENSSL; any other SslProvider value falls to the default branch which throws IllegalArgumentException. This guards against future/unknown netty SslProvider enum values.","triggerScenarios":"Passing an SslProvider other than JDK or OPENSSL (e.g. a value from a newer Netty version) into GrpcSslContexts.configure(builder, provider).","commonSituations":"Upgrading Netty to a version with new SslProvider constants while using an older grpc-netty; reflection/config-driven provider selection producing an unexpected enum.","solutions":["Pass SslProvider.JDK or SslProvider.OPENSSL explicitly","Align grpc-netty and netty versions so enum values match","Call the no-provider configure(builder) overload to let gRPC pick a provider automatically"],"exampleFix":"// before\nGrpcSslContexts.configure(builder, SslProvider.OPENSSL_REFCNT);\n// after\nGrpcSslContexts.configure(builder, SslProvider.OPENSSL);","handlingStrategy":"type-guard","validationCode":"if (provider != SslProvider.JDK && provider != SslProvider.OPENSSL) { throw new ConfigException(\"gRPC supports only JDK/OPENSSL SSL providers\"); }","typeGuard":"boolean isSupported(SslProvider p) { return p == SslProvider.JDK || p == SslProvider.OPENSSL; }","tryCatchPattern":"try { GrpcSslContexts.configure(b, provider); } catch (IllegalArgumentException e) { /* fall back to SslProvider.OPENSSL */ }","preventionTips":["Only pass JDK or OPENSSL to GrpcSslContexts.configure","Keep grpc-netty and Netty versions aligned","Avoid reflection-driven enum selection from config"],"tags":["grpc","tls","netty","enum","invalid-argument"],"backgroundTag":"unsupported-enum-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}