{"record":{"id":"f11d1b008b564d2f","repo":"grpc/grpc-java","slug":"tls-provider-failure","errorCode":null,"errorMessage":"TLS Provider failure","messagePattern":"TLS Provider failure","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"okhttp/src/main/java/io/grpc/okhttp/OkHttpChannelBuilder.java","lineNumber":609,"sourceCode":"  }\n\n  void setStatsEnabled(boolean value) {\n    this.managedChannelImplBuilder.setStatsEnabled(value);\n  }\n\n  @VisibleForTesting\n  @Nullable\n  SSLSocketFactory createSslSocketFactory() {\n    switch (negotiationType) {\n      case TLS:\n        try {\n          if (sslSocketFactory == null) {\n            SSLContext sslContext = SSLContext.getInstance(\"Default\", Platform.get().getProvider());\n            sslSocketFactory = sslContext.getSocketFactory();\n          }\n          return sslSocketFactory;\n        } catch (GeneralSecurityException gse) {\n          throw new RuntimeException(\"TLS Provider failure\", gse);\n        }\n      case PLAINTEXT:\n        return null;\n      default:\n        throw new RuntimeException(\"Unknown negotiation type: \" + negotiationType);\n    }\n  }\n\n\n\n  private static final EnumSet<TlsChannelCredentials.Feature> understoodTlsFeatures =\n      EnumSet.of(\n          TlsChannelCredentials.Feature.MTLS, TlsChannelCredentials.Feature.CUSTOM_MANAGERS);\n\n  static SslSocketFactoryResult sslSocketFactoryFrom(ChannelCredentials creds) {\n    if (creds instanceof TlsChannelCredentials) {\n      TlsChannelCredentials tlsCreds = (TlsChannelCredentials) creds;\n      Set<TlsChannelCredentials.Feature> incomprehensible =","sourceCodeStart":591,"sourceCodeEnd":627,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/okhttp/src/main/java/io/grpc/okhttp/OkHttpChannelBuilder.java#L591-L627","documentation":"OkHttpChannelBuilder.createSslSocketFactory wraps GeneralSecurityException from SSLContext.getInstance(\"Default\") / getSocketFactory() in a RuntimeException. It means the default TLS provider cannot supply an SSL socket factory, typically because the platform provider is broken or missing TLS support.","triggerScenarios":"Building an OkHttpChannel with negotiationType TLS when sslSocketFactory was not supplied, and SSLContext.getInstance(\"Default\", provider) throws GeneralSecurityException (provider unavailable, no TLS algorithm, misconfigured security provider).","commonSituations":"Custom JVMs without default TLS provider (early access/limited JDK builds), overridden security providers, Android devices lacking a proper TLS provider, registerProvider mistakes.","solutions":["Supply an explicit SslSocketFactory via okHttpChannelBuilder.sslSocketFactory(...) so gRPC does not need the default SSLContext","Check registered security providers (Security.getProviders()) and ensure a provider supporting SSLContext.TLS is present","Call Platform.get().getProvider() logic implicitly — verify the Conscrypt/Google Play provider is installed on constrained platforms","Use usePlaintext() if TLS is genuinely not needed"],"exampleFix":"// before\nOkHttpChannel.forAddress(host, port).build(); // TLS default, provider failure\n// after\nSSLSocketFactory factory = (SSLSocketFactory) SSLSocketFactory.getDefault();\nOkHttpChannel.forAddress(host, port).sslSocketFactory(factory).build();","handlingStrategy":"fallback","validationCode":"try { SSLContext.getInstance(\"Default\"); } catch (GeneralSecurityException e) { /* supply explicit sslSocketFactory */ }","typeGuard":null,"tryCatchPattern":"try { builder.build(); } catch (RuntimeException e) { if (e.getMessage().contains(\"TLS Provider failure\")) { builder.sslSocketFactory(defaultFactory()); return builder.build(); } throw e; }","preventionTips":["Always provide an explicit SSLSocketFactory in constrained runtimes","Verify security providers at app startup","Prefer plaintext only when explicitly safe"],"tags":["grpc","okhttp","tls","security-provider"],"backgroundTag":"unsupported-platform","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}