grpc/grpc-java · error · CertificateException

Not enough information to validate peer. SSLEngine or Socket

Error message

Not enough information to validate peer. SSLEngine or Socket required.

What it means

AdvancedTlsX509TrustManager.checkClientTrusted(X509Certificate[], String) intentionally always throws CertificateException: with only the certificate chain and authType there is not enough information to verify the peer, so verification must use the Socket- or SSLEngine-taking overloads or a custom socketAndEnginePeerVerifier.

Source

Thrown at util/src/main/java/io/grpc/util/AdvancedTlsX509TrustManager.java:77

  private static final int MINIMUM_REFRESH_PERIOD_IN_MINUTES = 1;
  private static final String NOT_ENOUGH_INFO_MESSAGE =
      "Not enough information to validate peer. SSLEngine or Socket required.";
  private final Verification verification;
  private final SslSocketAndEnginePeerVerifier socketAndEnginePeerVerifier;

  // The delegated trust manager used to perform traditional certificate verification.
  private volatile X509ExtendedTrustManager delegateManager = null;

  private AdvancedTlsX509TrustManager(Verification verification,
      SslSocketAndEnginePeerVerifier socketAndEnginePeerVerifier) {
    this.verification = verification;
    this.socketAndEnginePeerVerifier = socketAndEnginePeerVerifier;
  }

  @Override
  public void checkClientTrusted(X509Certificate[] chain, String authType)
      throws CertificateException {
    throw new CertificateException(NOT_ENOUGH_INFO_MESSAGE);
  }

  @Override
  public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket)
      throws CertificateException {
    checkTrusted(chain, authType, null, socket, false);
  }

  @Override
  public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine)
      throws CertificateException {
    checkTrusted(chain, authType, engine, null, false);
  }

  @Override
  public void checkServerTrusted(X509Certificate[] chain,  String authType, SSLEngine engine)
      throws CertificateException {
    checkTrusted(chain, authType, engine, null, true);

View on GitHub (pinned to 64daddc1f3)

Solutions

1. Use checkClientTrusted(chain, authType, Socket) or (chain, authType, SSLEngine) overloads instead of the 2-arg form
2. Provide an AdvancedTlsX509TrustManager.ForTesting constructor with a custom socketAndEnginePeerVerifier for non-standard transports
3. Ensure the TLS provider supports the X509ExtendedTrustManager overloads this manager implements
4. Switch to a plain X509TrustManager if peer verification must rely solely on chain/authType

Example fix

// before
trustManager.checkClientTrusted(chain, authType); // always throws
// after
trustManager.checkClientTrusted(chain, authType, sslSocket); // verify via socket peer

boolean needsPeerOverload(X509TrustManager m) { return m instanceof AdvancedTlsX509TrustManager; }

try { tm.checkClientTrusted(chain, authType); } catch (CertificateException e) { tm.checkClientTrusted(chain, authType, socket); }

When it happens

Trigger: Using AdvancedTlsX509TrustManager in a context that invokes the two-argument X509TrustManager.checkClientTrusted overload, e.g. default TLS stacks or code that downcasts the manager to X509TrustManager and calls the base method.

Common situations: Plugging this manager into libraries that only call the 2-arg methods; missing a custom X509SocketAndEnginePeerVerifier when hostnames/peers are resolved outside Socket/SSLEngine.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• Can't set TLS settings for ALTS
• TLS not supported in BinderServer
• This method is deprecated and marked for removal. Use the ge
• TLS not supported in ServerImplBuilder
• TLS not supported in InProcessServer

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/05ab35bec63ce0bb. Report an issue: GitHub.