security configuration on the server-side does not contain i

Error message

security configuration on the server-side does not contain identity certificate provider instance name

What it means

Returned by securityConfigFromCommonTLSContext (unmarshal_cds.go:413-414) for a server-side security config when IdentityInstanceName is empty. The identity (server) certificate is mandatory for serving TLS, so a security block without an identity cert provider instance name is invalid. The server flag branch (server==true) enforces this after both new and deprecated field parsing.

Source

Thrown at internal/xds/xdsclient/xdsresource/unmarshal_cds.go:414

	// For now, if we can't get a valid security config from the new fields, we
	// fallback to the old deprecated fields.
	// TODO: Drop support for deprecated fields. NACK if err != nil here.
	sc, err1 := securityConfigFromCommonTLSContextUsingNewFields(common, server)
	if sc == nil || sc.Equal(&SecurityConfig{}) {
		var err error
		sc, err = securityConfigFromCommonTLSContextWithDeprecatedFields(common, server)
		if err != nil {
			// Retain the validation error from using the new fields.
			return nil, errors.Join(err1, fmt.Errorf("failed to parse config using deprecated fields: %v", err))
		}
	}
	if sc != nil {
		// sc == nil is a valid case where the control plane has not sent us any
		// security configuration. xDS creds will use fallback creds.
		if server {
			if sc.IdentityInstanceName == "" {
				return nil, errors.New("security configuration on the server-side does not contain identity certificate provider instance name")
			}
		} else {
			if !sc.UseSystemRootCerts && sc.RootInstanceName == "" {
				return nil, errors.New("security configuration on the client-side does not contain root certificate provider instance name")
			}
		}
	}
	return sc, nil
}

func securityConfigFromCommonTLSContextWithDeprecatedFields(common *v3tlspb.CommonTlsContext, server bool) (*SecurityConfig, error) {
	// The `CommonTlsContext` contains a
	// `tls_certificate_certificate_provider_instance` field of type
	// `CertificateProviderInstance`, which contains the provider instance name
	// and the certificate name to fetch identity certs.
	sc := &SecurityConfig{}
	if identity := common.GetTlsCertificateCertificateProviderInstance(); identity != nil {
		sc.IdentityInstanceName = identity.GetInstanceName()

View on GitHub (pinned to 03255a9237)

Solutions

Populate the identity certificate provider instance (tls_certificate_certificate_provider_instance.instance_name) in the CommonTlsContext for the server.
Ensure the matching certificate provider is registered in the gRPC bootstrap so the instance name resolves.
If TLS should be disabled on that listener, remove the DownstreamTlsContext/transport_socket so sc stays nil.

Example fix

// before
//   common_tls_context: { validation_context: { ... } }   // no identity
// after
//   common_tls_context: {
//     tls_certificate_certificate_provider_instance: { instance_name: "default", certificate_name: "server" },
//     validation_context: { ... }
//   }

Defensive patterns

Strategy: validation

Validate before calling

func serverSecurityHasIdentity(sc *SecurityConfig) bool {
    return sc != nil && sc.IdentityInstanceName != ""
}

Prevention

Always set a tls_certificate_certificate_provider_instance for server-side TLS configs.
Ensure the identity provider instance name exists in the gRPC bootstrap.
Omit the security block entirely if TLS is not required.

When it happens

Trigger: A CommonTlsContext for the server side (DownstreamTlsContext, or the shared security parser invoked with server=true) that yields a non-nil SecurityConfig but with IdentityInstanceName=="". This happens when no tls_certificate certificate-provider-instance or legacy tls_certificates field is set.

Common situations: Control plane configures a downstream TLS context with a validation context (root) but forgets the identity/server cert provider; misnamed instance; bootstrap certificate provider not registered.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/bf984cf18c56a371. Report an issue: GitHub.