grpc/grpc-java · error · UnsupportedOperationException

This method is deprecated and marked for removal. Use the ge

Error message

This method is deprecated and marked for removal. Use the getPeerCertificates() method instead.

What it means

NoopSslSession is gRPC's placeholder SSLSession for insecure/non-TLS transports. The getPeerCertificateChain() method (javax.security.cert.X509Certificate based, deprecated since Java 9) intentionally always throws UnsupportedOperationException to steer callers to getPeerCertificates().

Source

Thrown at core/src/main/java/io/grpc/internal/NoopSslSession.java:42

/** A no-op ssl session, to facilitate overriding only the required methods in specific
 * implementations.
 */
public class NoopSslSession implements SSLSession {
  @Override
  public byte[] getId() {
    return new byte[0];
  }

  @Override
  public SSLSessionContext getSessionContext() {
    return null;
  }

  @Override
  @SuppressWarnings("deprecation")
  public javax.security.cert.X509Certificate[] getPeerCertificateChain() {
    throw new UnsupportedOperationException("This method is deprecated and marked for removal. "
            + "Use the getPeerCertificates() method instead.");
  }

  @Override
  public long getCreationTime() {
    return 0;
  }

  @Override
  public long getLastAccessedTime() {
    return 0;
  }

  @Override
  public void invalidate() {
  }

  @Override

View on GitHub (pinned to 64daddc1f3)

Solutions

Call getPeerCertificates() (SSLSession API) instead of getPeerCertificates() deprecated chain counterpart
Check whether the channel is actually using TLS before reading peer certs; plaintext sessions are NoopSslSession and have no peer certificates
Handle UnsupportedOperationException defensively when reading certs from unknown transports
Cast/handle the cert array as java.security.cert.X509Certificate rather than javax.security.cert.X509Certificate

Example fix

// before
javax.security.cert.X509Certificate[] certs = session.getPeerCertificateChain();
// after
java.security.cert.X509Certificate[] certs = session.getPeerCertificates();

Defensive patterns

Strategy: try-catch

Validate before calling

boolean hasTls = channel instanceof io.grpc.internal.ManagedChannelImpl /* check via transport attrs */;
SSLSession s = call.getAttributes().get(Grpc.TRANSPORT_ATTR_SSL_SESSION);
if (s == null || s.getClass().getSimpleName().equals("NoopSslSession")) return;

Type guard

static boolean hasRealSslSession(SSLSession s) {
  return s != null && !(s.getClass().getSimpleName().equals("NoopSslSession"));
}

Try / catch

try { certs = session.getPeerCertificates(); } catch (UnsupportedOperationException | SSLPeerUnverifiedException e) { certs = null; }

Prevention

Use getPeerCertificates(), never the deprecated getPeerCertificateChain()
Only read peer certs when TLS is actually enabled
Handle NoopSslSession/empty cert arrays as "no TLS"

When it happens

Trigger: Calling getPeerCertificateChain() on an SSLSession obtained from a gRPC transport's attributes (GRPC_TRANSPORT_ATTR_SSL_SESSION) when that session is a NoopSslSession, e.g. on plaintext channels.

Common situations: Code inspecting peer certs without checking whether TLS is actually enabled; old code using deprecated javax.security.cert APIs (also flagged for removal by Jakarta/Java 11+).

Understand the failure class

Background: "is deprecated and will be removed" — deprecation warnings for old API names, keywords, and options, and how to migrate before the removal release — this error's family across 29 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/5aa22a2607f9b0b0. Report an issue: GitHub.