Comments (7)
On Sat, Mar 7, 2015 at 12:02 AM, prazzt [email protected] wrote:
My first impression was "TLS client certificate authentication", i.e.
distinguish each clients by certificate that they sent. But from cursory
look, turns out it's actually certificate pinning.. making sure client
talks with pinned server CA.Am I right, or does grpc actually supports client certificate
authentication ?Currently, we do not support client certificate authentication
(i.e., NoClientCert is used). But it is not hard to add if it is needed.
The name basically means creating a TLS grpc credential for client from a
cert (ca).—
Reply to this email directly or view it on GitHub
#107.
from grpc-go.
how about NewClientTLSFromCA?
from grpc-go.
So this is basically certificate pinning right ?
How is the expected usage here ? does clientCert == serverCert ?
from grpc-go.
I do not think we do extra work besides the normal TLS handshake.
This is more like a browser->web service type of usage -- clients do not have their own certs but root CA.
from grpc-go.
I see another issue got confused also by TLS client certificate ..
I propose the following signatures:
// NewClient constructs secure connection for client with optional rootCA
func NewClient(server string, rootCA *x509.CertPool) TransportAuthenticator {}
// NewClientFile constructs secure connection by loading rootCA from local file
func NewClientFile(server, rootCAFile string) TransportAuthenticator {}
// NewServer constructs a new server
func NewServer(cert *tls.Certificate) TransportAuthenticator {}
// NewServerFile constructs a new server by loading cert and key from local file
func NewServerFile(certFile, keyFile string) (TransportAuthenticator, error) {}
This way it's shorter (we know it's always TLS anyway), and people don't confuse for "TLS client authentication"
from grpc-go.
Nah, it is not TLS always. We will support SSH too. And we are working on some Google internal transport security protocol too. Therefore, you need to have TLS in the names. In addition, I prefer "XXXFromFile" to "XXXFile". Plus, it is not necessary a local file (e.g., it could be at NFS.).
from grpc-go.
I see. Hope it doesn't get too bloated in the future. Closing this.
from grpc-go.
Related Issues (20)
- grpc: error unmarshalling request: failed to unmarshal, message is X, want proto.Message HOT 1
- Is it ok to call grpc.UnaryInvoker multiple times inside an interceptor? HOT 8
- Flaky Test: AllMetricsOneFunction HOT 1
- Why does connection to `localhost` fail on local ? HOT 15
- transition from TRANSIENT_FAILURE to IDLE HOT 1
- Is waitForReady required for retry policies? HOT 7
- Add godoc linter HOT 8
- How can I configure a usable gRPC-Go Retry Policy? HOT 9
- failed to install [email protected] HOT 13
- design tradeoffs about not including ctx in method argument for generated stream handler HOT 3
- google.protobuf.Empty as response serializes to not empty response depending on request headers HOT 2
- How to make server-stream run in a non-blocking state and handle other requests HOT 10
- Improve Logger Performance When Disabled HOT 5
- Flaky Test: RingHash_ReattemptWhenGoingFromTransientFailureToIdle
- xdsclient: reduce the number of ADS requests
- grpctest: minor improvements to the test logger implementation
- xdsclient: support environment variable protection for fallback
- Incorporate `mem` package into custom HTTP/2 Framer
- Examples using the `experimental` stats package HOT 3
- about grpc.NewClient,It will not check the validity of the target ? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from grpc-go.