Repository navigation
[java-spanner-jdbc] Underlying Java spanner client attempting to use TLS despite usePlainText=true #12275
Description
Environment details
OS: Linux (Debian 14)
Java version: 17
java-spanner-jdbc version: 2.32.3
Steps to reproduce
- Attempt to connect via JDBC to local Spanner emulator using usePlainText=true
- Observe it trying to connect via TLS
Code example
fun buildJdbcConnectionString(
emulatorHost: String,
project: String,
instance: String,
database: String,
): String {
return "jdbc:cloudspanner://$emulatorHost/projects/$project/instances/$instance/databases/" +
"$database;usePlainText=true;autoConfigEmulator=true"
} val connectionString =
SpannerEmulator.buildJdbcConnectionString(emulatorHost, PROJECT, INSTANCE, databaseId)
DriverManager.getConnection(connectionString).use { connection ->
Liquibase.update(connection, changelogPath)
}Stack trace
There's no exception thrown. This stack trace is from my test timing out.
app//com.google.auth.mtls.SecureConnectProvider.runCertificateProviderCommand(SecureConnectProvider.java:163)
at app//com.google.auth.mtls.SecureConnectProvider.getKeyStore(SecureConnectProvider.java:142)
at app//com.google.auth.mtls.SecureConnectProvider.getKeyStore(SecureConnectProvider.java:106)
at app//com.google.auth.mtls.SecureConnectProvider.isAvailable(SecureConnectProvider.java:127)
at app//com.google.auth.mtls.DefaultMtlsProviderFactory.create(DefaultMtlsProviderFactory.java:60)
at app//com.google.api.gax.rpc.EndpointContext$Builder.determineEndpoint(EndpointContext.java:297)
at app//com.google.api.gax.rpc.EndpointContext$Builder.build(EndpointContext.java:411)
at app//com.google.api.gax.rpc.StubSettings.buildEndpointContext(StubSettings.java:129)
at app//com.google.api.gax.rpc.StubSettings.<init>(StubSettings.java:110)
at app//com.google.cloud.spanner.v1.stub.SpannerStubSettings.<init>(SpannerStubSettings.java:405)
at app//com.google.cloud.spanner.v1.stub.SpannerStubSettings$Builder.build(SpannerStubSettings.java:823)
at app//com.google.cloud.spanner.spi.v1.GapicSpannerRpc.<init>(GapicSpannerRpc.java:474)
at app//com.google.cloud.spanner.spi.v1.GapicSpannerRpc.<init>(GapicSpannerRpc.java:290)
at app//com.google.cloud.spanner.SpannerOptions$DefaultSpannerRpcFactory.create(SpannerOptions.java:644)
at app//com.google.cloud.spanner.SpannerOptions$DefaultSpannerRpcFactory.create(SpannerOptions.java:639)
at app//com.google.cloud.ServiceOptions.getRpc(ServiceOptions.java:602)
at app//com.google.cloud.spanner.SpannerOptions.getSpannerRpcV1(SpannerOptions.java:2207)
at app//com.google.cloud.spanner.SpannerImpl.<init>(SpannerImpl.java:155)
at app//com.google.cloud.spanner.SpannerOptions$DefaultSpannerFactory.create(SpannerOptions.java:634)
at app//com.google.cloud.spanner.SpannerOptions$DefaultSpannerFactory.create(SpannerOptions.java:629)
at app//com.google.cloud.ServiceOptions.getService(ServiceOptions.java:582)
at app//com.google.cloud.spanner.connection.SpannerPool.createSpanner(SpannerPool.java:425)
at app//com.google.cloud.spanner.connection.SpannerPool.getSpanner(SpannerPool.java:341)
at app//com.google.cloud.spanner.connection.ConnectionImpl.<init>(ConnectionImpl.java:318)
at app//com.google.cloud.spanner.connection.ConnectionOptions.getConnection(ConnectionOptions.java:893)
at app//com.google.cloud.spanner.jdbc.AbstractJdbcConnection.<init>(AbstractJdbcConnection.java:68)
at app//com.google.cloud.spanner.jdbc.JdbcConnection.<init>(JdbcConnection.java:97)
at app//com.google.cloud.spanner.jdbc.JdbcDriver.connect(JdbcDriver.java:232)
at platform/java.sql@17.0.14/java.sql.DriverManager.getConnection(DriverManager.java:681)
at platform/java.sql@17.0.14/java.sql.DriverManager.getConnection(DriverManager.java:252)
Any additional information below
I observed this after upgrading my client libraries by updating my version of the Google Cloud Libraries BOM.
It appears that the connection goes through eventually, but it's slow enough that my tests now time out.
I see the following warnings repeatedly in my logs:
Sep 20, 2025 1:25:25 AM com.google.api.gax.rpc.EndpointContext$Builder determineEndpoint
WARNING: DefaultMtlsProviderFactory encountered unexpected IOException: SecureConnect: Cert provider command failed with exit code: 139
Activity
olavloite commentedon Sep 20, 2025
This is caused by googleapis/sdk-platform-java#3852
Filed googleapis/sdk-platform-java#3911
olavloite commentedon Sep 20, 2025
There is unfortunately no code path or configuration option that available that allows us to disable this check. The only alternative is to overwrite the code. So if you need a workaround until googleapis/sdk-platform-java#3911 has been fixed, then you need to overwrite the offending code. This can be done in two ways:
See googleapis/java-spanner#4052, and then specifically the file DisableDefaultMtlsProvider
DefaultMtlsProviderFactoryclass manually by adding the following to your code and making sure this version of the class is loaded:SanjayVas commentedon Oct 10, 2025
googleapis/sdk-platform-java#3911 appears to have been marked as fixed, but the PR which fixes it mentions an environment variable that needs to be set for tests. I just want to make sure that if
usePlainText=trueis specified for the JDBC connection that it never attempts to use TLS.[-]Underlying Java spanner client attempting to use TLS despite usePlainText=true[/-][+][java-spanner-jdbc] Underlying Java spanner client attempting to use TLS despite usePlainText=true[/+]