security configuration on the server-side does not contain r

Error message

security configuration on the server-side does not contain root certificate provider instance name, but require_client_cert field is set

What it means

Returned by the downstream filter-chain security parser (unmarshal_lds.go:362-363) when the DownstreamTlsContext requires client certificates (require_client_certificate=true) but the resulting server-side SecurityConfig has no root certificate provider instance name. Mutual TLS requires a root/CA trust store to validate client certs, so requiring client auth without a root provider is contradictory and rejected.

Source

Thrown at internal/xds/xdsclient/xdsresource/unmarshal_lds.go:363

		return emptyFilterChain, fmt.Errorf("failed to unmarshal DownstreamTlsContext in LDS response: %v", err)
	}
	if downstreamCtx.GetRequireSni().GetValue() {
		return emptyFilterChain, fmt.Errorf("require_sni field set to true in DownstreamTlsContext message: %v", downstreamCtx)
	}
	if downstreamCtx.GetOcspStaplePolicy() != v3tlspb.DownstreamTlsContext_LENIENT_STAPLING {
		return emptyFilterChain, fmt.Errorf("ocsp_staple_policy field set to unsupported value in DownstreamTlsContext message: %v", downstreamCtx)
	}
	if downstreamCtx.GetCommonTlsContext() == nil {
		return emptyFilterChain, errors.New("DownstreamTlsContext in LDS response does not contain a CommonTlsContext")
	}
	sc, err := securityConfigFromCommonTLSContext(downstreamCtx.GetCommonTlsContext(), true)
	if err != nil {
		return emptyFilterChain, err
	}
	if sc != nil {
		sc.RequireClientCert = downstreamCtx.GetRequireClientCertificate().GetValue()
		if sc.RequireClientCert && sc.RootInstanceName == "" {
			return emptyFilterChain, errors.New("security configuration on the server-side does not contain root certificate provider instance name, but require_client_cert field is set")
		}
		fcc.SecurityCfg = sc
	}
	return fcc, nil
}

// dstPrefixEntry wraps DestinationPrefixEntry to track build state.
type dstPrefixEntry struct {
	entry         DestinationPrefixEntry
	rawBufferSeen bool
}

func buildFilterChainMap(fcs []*v3listenerpb.FilterChain) (NetworkFilterChainMap, error) {
	dstPrefixEntries := []*dstPrefixEntry{}
	for _, fc := range fcs {
		fcMatch := fc.GetFilterChainMatch()
		if fcMatch.GetDestinationPort().GetValue() != 0 {
			// Destination port is the first match criteria and we do not

View on GitHub (pinned to 03255a9237)

Solutions

Add a validation_context.certificate_provider_instance.instance_name (root cert provider) to the server CommonTlsContext so client certs can be validated.
If client-cert auth is not actually required, set require_client_certificate to false.
Verify the root cert provider referenced is registered in bootstrap and provides a CA bundle.

Example fix

// before
//   downstream_tls_context: {
//     common_tls_context: { tls_certificate_certificate_provider_instance: {...} },
//     require_client_certificate: true            // no validation_context
//   }
// after
//   downstream_tls_context: {
//     common_tls_context: {
//       tls_certificate_certificate_provider_instance: {...},
//       validation_context: { certificate_provider_instance: { instance_name: "default", certificate_name: "ca" } }
//     },
//     require_client_certificate: true
//   }

Defensive patterns

Strategy: validation

Validate before calling

func mTLSServerHasRoots(sc *SecurityConfig) bool {
    if sc == nil { return true } // no security block
    if !sc.RequireClientCert { return true }
    return sc.RootInstanceName != ""
}

Prevention

Whenever require_client_certificate is true, set a validation_context root provider.
If client cert auth is optional, set require_client_certificate to false instead.
Cross-check the root provider instance name against bootstrap before rollout.

When it happens

Trigger: An LDS filter chain sets DownstreamTlsContext.require_client_certificate=true but the CommonTlsContext lacks a validation_context / certificate_provider_instance for root certs. After securityConfigFromCommonTLSContext returns sc, the code sets RequireClientCert and checks RootInstanceName=="" at line 362.

Common situations: Control plane enables require_client_certificate but forgets the validation_context; a config edit that removed the root provider while keeping mTLS on; bootstrap missing the root cert provider.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/cc10603ea274f6a4. Report an issue: GitHub.