Standard grpc mTLS #3909
Draft
Standard grpc mTLS #3909
+287
−189
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #3909 +/- ##
==========================================
+ Coverage 89.10% 89.12% +0.01%
==========================================
Files 255 255
Lines 14600 14626 +26
==========================================
+ Hits 13010 13035 +25
- Misses 1590 1591 +1 ☔ View full report in Codecov by Sentry. |
…y root certificate
…generated signed server certificate. Client side ssl option is also updated accordingly. Unit tests are broken temporarily due to this change.
Added the root certificate and signed server certificate. Note, the client_cert key and certificate are default mock_ssl_cert_provider output and as a result these two variables are used as the server certificate key pair in almost all unit tests.
Made the mock_cert_provider using the default certificate and key pair which is the client_cert and client_key in the file mock_cert_provider.h. Meanwhile, the make_secure_stub is also updated to make the unit tests pass.
georgeliao
force-pushed
the
standard_grpc_mTLS
branch
from
2c7b8af to
a15d01c
Compare
georgeliao
force-pushed
the
standard_grpc_mTLS
branch
from
4731a24 to
f98f895
Compare
…e via X509Cert constructor overload.
…e 3 X509Cert constructors.
…ion x509 constructor into one.
…tent with other custom deleters. Meanwhile, it is also more explicit and preferred for clarity.
…function EVP_PKEY_CTX_set_params
georgeliao
force-pushed
the
standard_grpc_mTLS
branch
from
3294490 to
c815486
Compare
…ificate migration when the user upgrades multipass to the version includes this.
…and commit to release 1.52.1, which serves as the base for our patches. Then, remove the patch-related code.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
A few things to note:
The
make_cert_key_pairoriginally handles both server and client certificate-key pair generation.server_nameis used to tell which case it is. Whenserver_nameis an empty string, it is the client certificate-key case. With the standard grpc tls scheme, the root certificate-key pair is added. Now themake_cert_key_pairrole becomes still generating and holding server and client certificate-key pair. However, the server certificate one becomes signed server certificate. As the result of that, the server branch has to generate root certificate-key pair first and use them to sign the generated server certificate.WIP
/home/georgel/.local/share/multipass-client-certificate/multipass_cert.pem,
openssl x509 -in /root/.local/share/multipassd/certificates/localhost.pem -noout -text
/usr/local/share/ca-certificates/multipass_root_cert.pem
root cert attached to the server name?