grpc/grpc-java · error · IllegalArgumentException

Unsupported provider: ${provider}

Error message

Unsupported provider: ${provider}

What it means

The provider switch in GrpcSslContexts.configure() only handles JDK and OPENSSL; any other SslProvider value falls to the default branch which throws IllegalArgumentException. This guards against future/unknown netty SslProvider enum values.

Source

Thrown at netty/src/main/java/io/grpc/netty/GrpcSslContexts.java:188

              "Could not find Jetty NPN/ALPN or Conscrypt as installed JDK providers");
        }
        return configure(builder, jdkProvider);
      }
      case OPENSSL: {
        ApplicationProtocolConfig apc;
        if (OpenSsl.isAlpnSupported()) {
          apc = NPN_AND_ALPN;
        } else {
          apc = NPN;
        }
        return builder
            .sslProvider(SslProvider.OPENSSL)
            .ciphers(Http2SecurityUtil.CIPHERS, SupportedCipherSuiteFilter.INSTANCE)
            .applicationProtocolConfig(apc)
            .endpointIdentificationAlgorithm(DEFAULT_ENDPOINT_IDENTIFICATION_ALGORITHM);
      }
      default:
        throw new IllegalArgumentException("Unsupported provider: " + provider);
    }
  }

  /**
   * Set ciphers and APN appropriate for gRPC. Precisely what is set is permitted to change, so if
   * an application requires particular settings it should override the options set here. For
   * client builders, HTTPS endpoint identification is enabled by default.
   */
  @CanIgnoreReturnValue
  public static SslContextBuilder configure(SslContextBuilder builder, Provider jdkProvider) {
    ApplicationProtocolConfig apc;
    if (SUN_PROVIDER_NAME.equals(jdkProvider.getName())) {
      // Jetty ALPN/NPN only supports one of NPN or ALPN
      if (JettyTlsUtil.isJettyAlpnConfigured()) {
        apc = ALPN;
      } else if (JettyTlsUtil.isJettyNpnConfigured()) {
        apc = NPN;
      } else if (JettyTlsUtil.isJava9AlpnAvailable()) {

View on GitHub (pinned to 64daddc1f3)

Solutions

1. Pass SslProvider.JDK or SslProvider.OPENSSL explicitly
2. Align grpc-netty and netty versions so enum values match
3. Call the no-provider configure(builder) overload to let gRPC pick a provider automatically

Example fix

// before
GrpcSslContexts.configure(builder, SslProvider.OPENSSL_REFCNT);
// after
GrpcSslContexts.configure(builder, SslProvider.OPENSSL);

if (provider != SslProvider.JDK && provider != SslProvider.OPENSSL) { throw new ConfigException("gRPC supports only JDK/OPENSSL SSL providers"); }

boolean isSupported(SslProvider p) { return p == SslProvider.JDK || p == SslProvider.OPENSSL; }

try { GrpcSslContexts.configure(b, provider); } catch (IllegalArgumentException e) { /* fall back to SslProvider.OPENSSL */ }

When it happens

Trigger: Passing an SslProvider other than JDK or OPENSSL (e.g. a value from a newer Netty version) into GrpcSslContexts.configure(builder, provider).

Common situations: Upgrading Netty to a version with new SslProvider constants while using an older grpc-netty; reflection/config-driven provider selection producing an unexpected enum.

Related errors

• Could not find Jetty NPN/ALPN or Conscrypt as installed JDK
• Unknown provider; can't configure: ${jdkProvider}
• Could not find TLS ALPN provider; no working netty-tcnative,
• ${result.error}
• ${result.error}

AI-assisted analysis of grpc/grpc-java@64daddc1f3 (2026-09-08). Data as JSON: /api/errors/ea31925655734906. Report an issue: GitHub.