{"record":{"id":"fb89191ead476e44","repo":"grpc/grpc-java","slug":"response-from-s2a-server-does-not-contain-clienttl","errorCode":null,"errorMessage":"Response from S2A server does NOT contain ClientTlsConfiguration.","messagePattern":"Response from S2A server does NOT contain ClientTlsConfiguration\\.","errorType":"exception","errorClass":"S2AConnectionException","httpStatus":null,"severity":"error","filePath":"s2a/src/main/java/io/grpc/s2a/internal/handshaker/SslContextFactory.java","lineNumber":156,"sourceCode":"    }\n    return resp.getGetTlsConfigurationResp().getClientTlsConfiguration();\n  }\n\n  private static void configureSslContextWithClientTlsConfiguration(\n      GetTlsConfigurationResp.ClientTlsConfiguration clientTlsConfiguration,\n      SslContextBuilder sslContextBuilder)\n      throws CertificateException,\n          IOException,\n          KeyStoreException,\n          NoSuchAlgorithmException,\n          UnrecoverableKeyException {\n    sslContextBuilder.keyManager(createKeylessManager(clientTlsConfiguration));\n    ImmutableSet<String> tlsVersions;\n    tlsVersions =\n        ProtoUtil.buildTlsProtocolVersionSet(\n            clientTlsConfiguration.getMinTlsVersion(), clientTlsConfiguration.getMaxTlsVersion());\n    if (tlsVersions.isEmpty()) {\n      throw new S2AConnectionException(\n          \"Set of TLS versions received from S2A server is empty or not supported.\");\n    }\n    sslContextBuilder.protocols(tlsVersions);\n  }\n\n  private static KeyManager createKeylessManager(\n      GetTlsConfigurationResp.ClientTlsConfiguration clientTlsConfiguration)\n      throws CertificateException,\n          IOException,\n          KeyStoreException,\n          NoSuchAlgorithmException,\n          UnrecoverableKeyException {\n    X509Certificate[] certificates =\n        new X509Certificate[clientTlsConfiguration.getCertificateChainCount()];\n    for (int i = 0; i < clientTlsConfiguration.getCertificateChainCount(); ++i) {\n      certificates[i] = convertStringToX509Cert(clientTlsConfiguration.getCertificateChain(i));\n    }\n    KeyManager[] keyManagers =","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/s2a/src/main/java/io/grpc/s2a/internal/handshaker/SslContextFactory.java#L138-L174","documentation":"This throw site in configureSslContextWithClientTlsConfiguration fires when the set of TLS protocol versions computed from the S2A server's min/max TLS version values is empty or unsupported, i.e. no usable TLS version can be negotiated for the client SSLContext. The line 156 region shows the empty-set guard right after buildTlsProtocolVersionSet().","triggerScenarios":"SslContextFactory.createForClient() receives a ClientTlsConfiguration whose ProtoUtil.buildTlsProtocolVersionSet(minTlsVersion, maxTlsVersion) yields an empty set (unknown/unsupported min or max TLS version enum, or min > max).","commonSituations":"S2A server and gRPC version disagree on supported TLS version enums (e.g. server reports a TLS version the bundled netty-tcnative/BoringSSL does not support), or a misconfigured min/max pair.","solutions":["Check the min/max TLS version values returned by the S2A server and confirm they are supported by your gRPC/netty-tcnative version","Upgrade gRPC (and its TLS provider) so the S2A-reported TLS versions are recognized","Fix S2A server configuration to advertise supported TLS versions (e.g. TLS 1.2/1.3)","Ensure minTlsVersion is not greater than maxTlsVersion"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"ClientTlsConfiguration cfg = resp.getGetTlsConfigurationResp().getClientTlsConfiguration();\nSet<String> versions = ProtoUtil.buildTlsProtocolVersionSet(cfg.getMinTlsVersion(), cfg.getMaxTlsVersion());\nif (versions.isEmpty()) {\n  throw new IllegalStateException(\"S2A returned unsupported TLS versions: \"\n      + cfg.getMinTlsVersion() + \"..\" + cfg.getMaxTlsVersion());\n}","typeGuard":null,"tryCatchPattern":"try {\n  SslContext ctx = SslContextFactory.createForClient();\n} catch (S2AConnectionException e) {\n  if (e.getMessage().contains(\"Set of TLS versions\")) {\n    // upgrade gRPC/TLS provider or reconfigure S2A server TLS versions\n  }\n}","preventionTips":["Keep gRPC and its TLS provider (netty-tcnative) up to date with S2A-reported versions","Configure S2A to advertise TLS 1.2/1.3 only","Ensure min <= max TLS version on the server"],"tags":["grpc","s2a","tls","configuration"],"backgroundTag":"unsupported-config-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}