glbrntt
commented
3 years ago Also I read other issues and some pointed that it might be important the order in which "withTLS" is called.
That isn't correct: the order doesn't matter here.
What's the output when running your code?
Just a note: the following code isn't necessary; the TLS configuration you're making here is mirroring exactly what you're doing with the withTLS(...) functions on the builder. The same goes for creating the context and handler; this is all done internally by gRPC, you don't need to do this.
//Step ii: create TLS configuration var configuration = TLSConfiguration.forClient() configuration.trustRoots = .certificates(pemCert) configuration.certificateChain = [.certificate(serverSignedCert)] configuration.privateKey = .privateKey(privKey) configuration.certificateVerification = .fullVerification //Step iii: generate SSL context //TODO: Figure out exactly why this step is needed and how it works do { let sslContext = try NIOSSLContext(configuration: configuration) do { let handler = try NIOSSLClientHandler(context: sslContext, serverHostname: self.CONTROLLER_ADDRESS + "\(self.CONTROLLER_PORT)")
BioZrod
Lukasa
What are you trying to achieve?
I am trying to connect to a remote server using mutual TLS. First I created a GRPC connection to bootstrap and get a signed cert from server. Which successfully get a response from server and I get the cert bytes. After that using the signed cert I got from server I want to create a second GRPC connection but this connection requires me to set it using overrideAuthority, example of what I want to achieve in Java:
channel2 = OkHttpChannelBuilder.forAddress("example.com", 443) .useTransportSecurity() .sslSocketFactory(context.getSocketFactory()) .overrideAuthority("metricsd-example.com") .build(); MetricsControllerGrpc.MetricsControllerBlockingStub stub2 = MetricsControllerGrpc.newBlockingStub(channel2);What have you tried so far?
I found the function withTLS(serverHostnameOverride: String) but i doesn't seem to change hostname when trying to connect to server. Also I read other issues and some pointed that it might be important the order in which "withTLS" is called.
builder = ClientConnection.secure(group: group).withTLS(certificateChain: [serverSignedCert]).withTLS(privateKey: privKey).withTLS(trustRoots: configuration.trustRoots!).withTLS(serverHostnameOverride: self.METRICS_AUTHORITY_HEADER)Here is the code of the function trying to set up the GRPC connection using withTLS(serverHostnameOverride: String)