pinpoint-apm/pinpoint · error · SSLException

can't find SslProvider. value:+providerType

Error message

can't find SslProvider. value:+providerType

What it means

SslContextFactory.getSslProvider maps a providerType string to netty's SslProvider enum: it tries OpenSSL variants then JDK, and throws SSLException("can't find SslProvider. value:...") when the string matches none. This catches configuration typos and unsupported provider names before any SSL context is built.

Source

Thrown at grpc/src/main/java/com/navercorp/pinpoint/grpc/security/SslContextFactory.java:141

        }

        LOGGER.info("Support cipher list : {} {}", sslContext, supportedCipherSuiteList);
    }

    SslProvider getSslProvider(String providerType) throws SSLException {
        if (StringUtils.isEmpty(providerType)) {
            return SslProvider.OPENSSL;
        }

        if (SslProvider.OPENSSL.name().equalsIgnoreCase(providerType)) {
            return SslProvider.OPENSSL;
        }

        if (SslProvider.JDK.name().equalsIgnoreCase(providerType)) {
            return SslProvider.JDK;
        }

        throw new SSLException("can't find SslProvider. value:" + providerType);
    }

}

View on GitHub (pinned to 744c3d3075)

Solutions

1. Set provider type to a valid value: OPENSSL, OPENSSL_REFCNT, or JDK.
2. Check the exact configured string for typos or stray characters (whitespace is not trimmed here).
3. If using OpenSSL, verify netty-tcnative/native transport is on the classpath or switch to JDK.
4. Log/print the resolved configuration value to confirm what the factory actually received.

Example fix

// before
client.ssl.provider.type=openssl-native
// after
client.ssl.provider.type=OPENSSL

String type = System.getProperty("client.ssl.provider.type", "");
Set<String> valid = Set.of("OPENSSL", "OPENSSL_REFCNT", "JDK");
if (!valid.contains(type.toUpperCase())) {
    throw new IllegalArgumentException("provider.type must be one of " + valid + ", got: " + type);
}

try {
    sslContext = SslContextFactory.create(...);
} catch (SSLException e) {
    if (e.getMessage().startsWith("can't find SslProvider")) {
        LOG.error("Bad ssl.provider.type config; falling back to JDK", e);
    }
    throw e;
}

When it happens

Trigger: Passing a providerType string (from the gRPC SSL config, e.g. client.ssl.provider.type or the collector equivalent) that is not one of the accepted values such as OPENSSL, OPENSSL_REFCNT, JDK — e.g. 'opensslSsl', 'native', or a misspelled value.

Common situations: Typo in properties file (case/spacing aside, equalsIgnoreCase is used for JDK/OpenSSL names so only genuinely wrong words fail); copying config from docs for a different library; value set via env var substitution that resolved to garbage.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Could not find file.(path:+filePath+)
• Illegal report period:
• cipherSuites must not be empty
• cipherSuite+ is not safe. Please check this url.(https://htt
• Unknown AgentType:

AI-assisted analysis of pinpoint-apm/pinpoint@744c3d3075 (2026-09-07). Data as JSON: /api/errors/aea3d12366f6b7d8. Report an issue: GitHub.