# gRPC: rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: x509: certificate signed by unknown authority"

**Code:** `gRPC: Ssl handshake failed / authentication handshake failed` · **Category:** SSL / TLS · **Seen on:** SSL, Go

A gRPC client could not complete TLS to the server — untrusted certificate, name mismatch, or plaintext/TLS mismatch.

## Meaning

gRPC requires you to choose TLS or insecure explicitly. Insecure client to a TLS server (or vice versa) gives handshake errors. Use the hostname in the certificate (`ServerName`), load the CA with `credentials.NewClientTLSFromFile`, and ensure ALPN `h2` is supported by proxies/load balancers.

## Common causes

- Client using insecure credentials against a TLS port (or reverse)
- Certificate not trusted by the client
- SNI/server name mismatch
- Load balancer without HTTP/2 (ALPN h2) support
- Expired certificate

## Quick fix

1. Match client and server modes (TLS vs insecure)
2. Provide the CA file or system roots
3. Set the correct server name override when testing

## Detailed fix by platform

### Linux

1. `grpcurl -cacert ca.pem host:443 list` or `grpcurl -plaintext host:50051 list` to test both modes

## How to diagnose

1. **Mode** — TLS or plaintext?
2. **CA** — Trusted?
3. **ALPN** — h2 supported?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/ssl/grpc-ssl-handshake-failed)