Only check ALPN if TLS extensions are enabled

megla-tlanghorst · megla-tlanghorst · commit 5fb58feac4cf · 2026-03-06T14:19:33.000+01:00
diff --git a/okhttp/src/main/java/io/grpc/okhttp/TlsServerHandshakerSocketFactory.java b/okhttp/src/main/java/io/grpc/okhttp/TlsServerHandshakerSocketFactory.java
@@ -55,13 +55,16 @@ public HandshakeResult handshake(Socket socket, Attributes attributes) throws IO
     SSLSocket sslSocket = (SSLSocket) socket;
     sslSocket.setUseClientMode(false);
     connectionSpec.apply(sslSocket, false);
-    Protocol expectedProtocol = Protocol.HTTP_2;
-    String negotiatedProtocol = OkHttpProtocolNegotiator.get().negotiate(
-        sslSocket,
-        null,
-        connectionSpec.supportsTlsExtensions() ? Collections.singletonList(expectedProtocol) : null);
-    if (!expectedProtocol.toString().equals(negotiatedProtocol)) {
-      throw new IOException("Expected NPN/ALPN " + expectedProtocol + ": " + negotiatedProtocol);
+    if (connectionSpec.supportsTlsExtensions()) {
+      Protocol expectedProtocol = Protocol.HTTP_2;
+      String negotiatedProtocol = OkHttpProtocolNegotiator.get().negotiate(
+          sslSocket,
+          null,
+          Collections.singletonList(expectedProtocol)
+      );
+      if (!expectedProtocol.toString().equals(negotiatedProtocol)) {
+        throw new IOException("Expected NPN/ALPN " + expectedProtocol + ": " + negotiatedProtocol);
+      }
     }
     attributes = result.attributes.toBuilder()
         .set(GrpcAttributes.ATTR_SECURITY_LEVEL, SecurityLevel.PRIVACY_AND_INTEGRITY)
