Explain Google PubSub gRPC rootCa setting

[jrudolph]

The reference.conf says this:

alpakka.google.cloud.pubsub.grpc {
  host = "pubsub.googleapis.com"
  port = 443

  # Set to "none" to disable TLS
  # TLS and certificates should be configured via the underlying
  # SSL-config library
  # https://lightbend.github.io/ssl-config/WSQuickStart.html#point-the-trust-manager-at-the-pem-file
  # rootCa = "none"

  # Supported values:
  # * google-application-default
  # * none
  callCredentials = "google-application-default"
}

but it's unclear what you should put in there for connecting to the official pubsub.googleapis.com which provides a trusted certificate.

• When would you put in a custom certificate?
• What is the exact format of putting a certificate in there?
• How can you use TLS and use the JDK-configured trust anchors?

See https://stackoverflow.com/questions/61793072/akka-stream-alpakka-google-cloud-pub-sub-grpc-grpc-http2exception?noredirect=1#comment109433954_61793072

[raboof]

This is slightly improved in #2312 but would still be nice to make better ;)

[jrudolph]

Good to know :)