grpc/grpc-go · critical

xds: CertificateProvider to fetch identity certificate is mi

Error message

xds: CertificateProvider to fetch identity certificate is missing, cannot perform TLS handshake. Please check configuration on the management server

What it means

Returned by HandshakeInfo.serverSideTLSConfigInternal (internal/credentials/xds/handshake_info.go:334) when hi.identityProvider == nil. On the server side the identity provider (the server's own cert+key to present during the handshake) is mandatory — root provider is optional depending on mTLS. A nil identity provider means the xDS management server's DownstreamTlsContext (server side) did not supply a certificate provider, so the server has nothing to present and cannot complete a TLS handshake.

Source

Thrown at internal/credentials/xds/handshake_info.go:334

			// TODO: Print the complete certificate once the x509 package
			// supports a String() method on the Certificate type.
			return fmt.Errorf("xds: received SANs {DNSNames: %v, EmailAddresses: %v, IPAddresses: %v, URIs: %v} do not match any of the accepted SANs", cert.DNSNames, cert.EmailAddresses, cert.IPAddresses, cert.URIs)
		}
		return nil
	}
}

// serverSideTLSConfigInternal constructs a tls.Config to be used in a
// server-side handshake based on the contents of the HandshakeInfo.
func (hi *HandshakeInfo) serverSideTLSConfigInternal(ctx context.Context) (*tls.Config, error) {
	cfg := &tls.Config{
		ClientAuth: tls.NoClientCert,
		NextProtos: []string{"h2"},
	}
	// On the server side, identityProvider is mandatory. RootProvider is
	// optional based on whether the server is doing TLS or mTLS.
	if hi.identityProvider == nil {
		return nil, errors.New("xds: CertificateProvider to fetch identity certificate is missing, cannot perform TLS handshake. Please check configuration on the management server")
	}
	if hi.requireClientCert {
		cfg.ClientAuth = tls.RequireAndVerifyClientCert
	}

	// identityProvider is mandatory on the server side.
	km, err := hi.identityProvider.KeyMaterial(ctx)
	if err != nil {
		return nil, fmt.Errorf("xds: fetching identity certificates from CertificateProvider failed: %v", err)
	}
	cfg.Certificates = km.Certs

	if hi.rootProvider != nil {
		km, err := hi.rootProvider.KeyMaterial(ctx)
		if err != nil {
			return nil, fmt.Errorf("xds: fetching trusted roots from CertificateProvider failed: %v", err)
		}
		if km.SPIFFEBundleMap != nil && hi.requireClientCert {

View on GitHub (pinned to 03255a9237)

Solutions

1. On the management server, ensure the server-side TLS config includes tls_certificates (or a certificate_provider_instance) providing the identity cert+key.
2. Verify the certprovider plugin named in the config is registered/imported by the server binary.
3. If mTLS is not required, still provide a server identity cert — the server always needs one for TLS.
4. Dump the LDS resource for the server listener and confirm the certificate chain is present.

Example fix

// Conceptual: fix is on the xDS control plane.
// before (server-side UpstreamTlsContext missing tls_certificates)
// common_tls_context:
//   validation_context: {...}   # only validation, no identity

// after
// common_tls_context:
//   tls_certificates:
//     - certificate_chain: {filename: "/etc/grpc/server.pem"}
//       private_key:      {filename: "/etc/grpc/server.key"}
//   validation_context: {...}

// Server-side: ensure the certprovider plugin is imported so identity certs
// can be provided, and verify the control plane ships tls_certificates.
// import _ "google.golang.org/grpc/credentials/tls/certprovider/pemfile"
// No pure-client validation can create the missing identity; it must be fixed
// on the management server.

// On the server, a missing identity provider fails inbound handshakes.
// Detect by logging and alert on the sentinel; restart after control-plane fix.
if err != nil && strings.Contains(err.Error(), "CertificateProvider to fetch identity certificate is missing") {
    alertOps("xDS control plane missing server identity cert")
}

When it happens

Trigger: An xDS-enabled server receives a connection whose UpstreamTlsContext/CommonTlsContext lacks tls_certificates / a default certificate provider. Surfaced at handshake time via ServerSideTLSConfig -> serverSideTLSConfigInternal, returned from ServerHandshake.

Common situations: Control plane (Istio/Envoy/Traffic Director) configured root/validation but forgot the server identity cert; cert rotation left a window with no identity provider; the referenced certificate provider instance name does not match any registered plugin; xDS push partially applied.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• xds: CertificateProvider to fetch trusted roots is missing,
• pemfile: certificate and key file must be in the same direct
• provider instance is closed
• missing fallback credentials
• ClientHandshake() is not supported for server credentials

AI-assisted analysis of grpc/grpc-go@03255a9237 (2026-08-07). Data as JSON: /api/errors/0aa161f6909e964a. Report an issue: GitHub.