#482·grpcurl

Dial fails with a timeout when the server requires a client certificate, but none is provided

Author: atollenaCreated Sep 9, 2024Updated Oct 22, 2025

When the server requires a client certificate, and grpcurl is not configured with the -cert/-key options, it fails with a timeout instead of an explicit message, even though the server communicates the problem with a certificate_required alert and closes the connection.

  1. Steps to reproduce: create a server that requires a client certificate (for example by modifying the grpc-go authentication to pass a tls.Config with tls.RequireAndVerifyClientCert).
  2. Run grpcurl -insecure localhost:50051 list

Expected output (this is what grpc-go outputs when letting an RPC fail or dialing WithBlock):

Failed to dial target host "localhost:50051": desc = "error reading server preface: remote error: tls: certificate required

Actual output:

Failed to dial target host "localhost:50051": context deadline exceeded

grpcurl seems to not consider the alert fatal and continue attempting to dial.

Screenshot 2024-09-09 at 11 07 24