{"record":{"id":"fa7a7ceb4c2f6450","repo":"grpc/grpc-java","slug":"require-signed-certificate-timestamp-in-default-va","errorCode":null,"errorMessage":"require_signed_certificate_timestamp in default_validation_context is not supported","messagePattern":"require_signed_certificate_timestamp in default_validation_context is not supported","errorType":"validation","errorClass":"ResourceInvalidException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/XdsClusterResource.java","lineNumber":519,"sourceCode":"            .getDefaultValidationContext();\n      }\n      if (certificateValidationContext != null) {\n        @SuppressWarnings(\"deprecation\") // gRFC A29 predates match_typed_subject_alt_names\n        int matchSubjectAltNamesCount = certificateValidationContext.getMatchSubjectAltNamesCount();\n        if (matchSubjectAltNamesCount > 0 && server) {\n          throw new ResourceInvalidException(\n              \"match_subject_alt_names only allowed in upstream_tls_context\");\n        }\n        if (certificateValidationContext.getVerifyCertificateSpkiCount() > 0) {\n          throw new ResourceInvalidException(\n              \"verify_certificate_spki in default_validation_context is not supported\");\n        }\n        if (certificateValidationContext.getVerifyCertificateHashCount() > 0) {\n          throw new ResourceInvalidException(\n              \"verify_certificate_hash in default_validation_context is not supported\");\n        }\n        if (certificateValidationContext.hasRequireSignedCertificateTimestamp()) {\n          throw new ResourceInvalidException(\n              \"require_signed_certificate_timestamp in default_validation_context is not \"\n                  + \"supported\");\n        }\n        if (certificateValidationContext.hasCrl()) {\n          throw new ResourceInvalidException(\"crl in default_validation_context is not supported\");\n        }\n        if (certificateValidationContext.hasCustomValidatorConfig()) {\n          throw new ResourceInvalidException(\n              \"custom_validator_config in default_validation_context is not supported\");\n        }\n      }\n    }\n  }\n\n  private static String getIdentityCertInstanceName(CommonTlsContext commonTlsContext) {\n    if (commonTlsContext.hasTlsCertificateProviderInstance()) {\n      return commonTlsContext.getTlsCertificateProviderInstance().getInstanceName();\n    }","sourceCodeStart":501,"sourceCodeEnd":537,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/XdsClusterResource.java#L501-L537","documentation":"gRPC xDS rejects a CertificateValidationContext whose default_validation_context sets require_signed_certificate_timestamp. Signed certificate timestamp (CT) verification is not implemented in grpc-java's xDS security layer, so the cluster resource is rejected with ResourceInvalidException.","triggerScenarios":"validateCommonTlsContext (via validateUpstreamTlsContext) sees CertificateValidationContext.require_signed_certificate_timestamp set inside default_validation_context of a cluster's upstream_tls_context.","commonSituations":"Certificate-transparency compliance configs from Envoy carried over to gRPC xDS; security hardening tooling that toggles CT on all TLS contexts; control planes emitting the field by default.","solutions":["Remove require_signed_certificate_timestamp from default_validation_context","Validate CT out-of-band (e.g. at cert issuance) instead of in-band via xDS","Keep trust anchored with trust_ca and SAN matching","Verify grpc-java release notes for CT support before re-adding"],"exampleFix":"# before\nvalidation_context:\n  default_validation_context:\n    require_signed_certificate_timestamp: true\n# after\nvalidation_context:\n  default_validation_context: {}","handlingStrategy":"validation","validationCode":"if (ctx.getDefaultValidationContext().hasRequireSignedCertificateTimestamp()) {\n  throw new IllegalArgumentException(\"require_signed_certificate_timestamp unsupported by grpc-java xDS\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  cluster = XdsClusterResource.parse(resource);\n} catch (ResourceInvalidException e) {\n  logger.warn(\"Cluster rejected: {}\", e.getMessage());\n}","preventionTips":["Disable CT toggles in generated xDS TLS contexts","Enforce certificate transparency at cert issuance pipelines instead","Check grpc-java release notes before enabling newer Envoy fields"],"tags":["xds","grpc-java","tls","certificate-transparency","unsupported-feature"],"backgroundTag":"unsupported-config-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}