ssl - 如何使用 TLS 连接到 GRPC？

Question

我试图让一个基本的 GRPC 服务器和客户端使用 SSL/TLS 以及一个节点客户端和 Java 服务器，但没有成功。从没有安全性开始:

// client.js
const creds = grpc.credentials.createInsecure()
const stub  = new hello_proto.Greeter('localhost:50051', creds)
stub.sayHello(...)

// server.java
Server server = ServerBuilder.forPort(50051)
  .addService(serviceImplementation)
  .build();
server.start();

这里的所有工作都按预期工作。然后我尝试添加 SSL 凭据，生成这样的证书和私钥(在 a Python example 之后):

$ openssl req -newkey rsa:2048 -nodes -keyout server.key -x509 -days 365 -out server.crt

这会生成证书 ( server.crt) 和私钥 ( server.key)。然后我按照 grpc.io Auth Guide 的指导将这些凭据添加到客户端和服务器(仅限服务器上的私钥)。和 grpc-java分别:

// client.js
const rootCert = fs.readFileSync("path/to/server.crt");
const channelCreds = grpc.credentials.createSsl(rootCert);
const stub = new hello_proto.Greeter('localhost:50051', channelCreds);
stub.sayHello(...)

// server.java
File certChainFile  = File("path/to/server.crt")
File privateKeyFile = File("path/to/server.key")
Server server = ServerBuilder.forPort(50051)
  .useTransportSecurity(certChainFile, privateKeyFile)
  .addService(serviceImplementation)
  .build();
server.start();

现在我收到一个错误 UNAVAILABLE: No connection established在客户端:

Error: 14 UNAVAILABLE: No connection established
    at Object.callErrorFromStatus (path/to/node_modules/@grpc/grpc-js/build/src/call.js:31:26)
    at Object.onReceiveStatus (path/to/node_modules/@grpc/grpc-js/build/src/client.js:176:52)
    at Object.onReceiveStatus (path/to/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:336:141)
    at Object.onReceiveStatus (path/to/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:299:181)
    at path/to/node_modules/@grpc/grpc-js/build/src/call-stream.js:130:78
    at processTicksAndRejections (node:internal/process/task_queues:76:11) {
  code: 14,
  details: 'No connection established',
  metadata: Metadata { internalRepr: Map(0) {}, options: {} }
}

服务器端没有错误。客户端错误与我在服务器关闭时得到的错误相同。
如何在 Java 服务器和节点客户端之间实现基本 TLS 身份验证？

Answer 1

也许你可以引用我的代码 helloworlde/grpc-java-sample ，随意翻译中文；
双方需要SslContext

服务器

       File keyCertChainFile = new File("server.pem");
       File keyFile = new File("server.key");
       SslContext sslContext = GrpcSslContexts.forServer(keyCertChainFile, keyFile)
                                              .clientAuth(ClientAuth.OPTIONAL)
                                              .build();

       Server server = NettyServerBuilder.forAddress(new InetSocketAddress(9090))
                                          .addService(new HelloServiceImpl())
                                          .sslContext(sslContext)
                                          .build();

客户

        File trustCertCollectionFile = new File("server.pem");
        SslContext sslContext = GrpcSslContexts.forClient()
                                            .trustManager(trustCertCollectionFile)
                                            .build();

        ManagedChannel channel = NettyChannelBuilder.forAddress("127.0.0.1", 9090)
                                                    .overrideAuthority("localhost")
                                                    .sslContext(sslContext)
                                                    .build();