grpc/grpc-java · error · IllegalArgumentException

${result.error}

Error message

${result.error}

What it means

InternalNettyServerCredentials.toNegotiator() converts ServerCredentials via ProtocolNegotiators.from(); unsupported credential types yield a result.error string which is thrown as IllegalArgumentException. The Netty transport only understands credential types it knows how to negotiate.

Source

Thrown at netty/src/main/java/io/grpc/netty/InternalNettyServerCredentials.java:56

   * Creates a {@link ServerCredentials} that will use the provided {@code negotiator}. Use of
   * {@link #create(io.grpc.netty.InternalProtocolNegotiator.ProtocolNegotiator)} is preferred over
   * this method when possible.
   */
  public static ServerCredentials create(InternalProtocolNegotiator.ServerFactory negotiator) {
    return NettyServerCredentials.create(negotiator);
  }

  /**
   * Converts a {@link ServerCredentials} to a negotiator, in similar fashion as for a new server.
   *
   * @throws IllegalArgumentException if unable to convert
   */
  public static InternalProtocolNegotiator.ServerFactory toNegotiator(
      ServerCredentials serverCredentials) {
    final ProtocolNegotiators.FromServerCredentialsResult result =
        ProtocolNegotiators.from(serverCredentials);
    if (result.error != null) {
      throw new IllegalArgumentException(result.error);
    }
    final class ServerFactory implements InternalProtocolNegotiator.ServerFactory {
      @Override
      public InternalProtocolNegotiator.ProtocolNegotiator newNegotiator(
          ObjectPool<? extends Executor> offloadExecutorPool) {
        return new InternalProtocolNegotiator.ProtocolNegotiatorAdapter(
            result.negotiator.newNegotiator(offloadExecutorPool));
      }
    }

    return new ServerFactory();
  }
}

View on GitHub (pinned to 64daddc1f3)

Solutions

1. Build credentials with TlsServerCredentials.newBuilder() or InsecureServerCredentials
2. Verify the credentials type is from grpc-netty-compatible APIs
3. Use NettyServerBuilder directly, which performs the same conversion with clearer paths

Example fix

// before
InternalNettyServerCredentials.toNegotiator(customServerCreds);
// after
InternalNettyServerCredentials.toNegotiator(TlsServerCredentials.newBuilder().keyManager(cert, key).build());

if (!(creds instanceof TlsServerCredentials) && !(creds instanceof InsecureServerCredentials)) { throw new IllegalArgumentException("Unsupported ServerCredentials for Netty"); }

boolean nettyCompatible(ServerCredentials c) { return c instanceof TlsServerCredentials || c instanceof InsecureServerCredentials; }

try { return InternalNettyServerCredentials.toNegotiator(creds); } catch (IllegalArgumentException e) { log.error("Unsupported server credentials: " + e.getMessage()); throw e; }

When it happens

Trigger: Passing a ServerCredentials implementation unknown to ProtocolNegotiators.from() into InternalNettyServerCredentials.toNegotiator().

Common situations: Using server credentials built by another transport module; custom ServerCredentials subclasses; internal plumbing errors when wiring custom protocol negotiators.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• ${result.error}
• ${result.error}
• Unsupported provider: ${provider}
• Cannot load EpollServerSocketChannel
• TsiHandshakeHandler encountered exception

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/61f49495e56e63cd. Report an issue: GitHub.