SSL Certification for GRPC

Question

Can you help me with ssl certification for gRPC server?

This is how i'm doing it with C# Core Console application:

const int Port = 50051;
const string host = "127.0.0.1";

var cacert = File.ReadAllText(@"Certs/ca.crt");
var servercert = File.ReadAllText(@"Certs/server.crt");
var serverkey = File.ReadAllText(@"Certs/server.key");
var keypair = new KeyCertificatePair(servercert, serverkey);
var sslCredentials = new SslServerCredentials(new List<KeyCertificatePair>() { keypair }, cacert, false);


var server = new Server()
{
    // setup host, port and server credentials
    Ports = { new ServerPort(host, Port, sslCredentials) },
    // register the service we built earlier
    Services = { Messages.BindService(new MessagesImpl()) }
};

server.Start();

I don't know how to provide SslServerCredentials in ASP.NET core gRPC Server?

cRPG server is started by adding in Stattup.cs file in section Configure:

public void ConfigureServices(IServiceCollection services)
{
    services.AddGrpc();
}

// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }

    app.UseRouting();

    app.UseEndpoints(endpoints =>
    {
        // Communication with gRPC endpoints must be made through a gRPC client.
        // To learn how to create a client, visit: https://go.microsoft.com/fwlink/?linkid=2086909
        endpoints.MapGrpcService<ServiceBaaseClass>();
    });
}

Answer 1

You should configure https when building the Host. That's in Program.cs, if you're using the grpc template.

Example:

public static IHostBuilder CreateHostBuilder(string[] args) =>
    Host.CreateDefaultBuilder(args)
        .ConfigureWebHostDefaults(webBuilder =>
        {
            webBuilder.ConfigureKestrel(options =>
            {
                options.ListenLocalhost(50051, listenOptions =>
                {
                    listenOptions.Protocols = HttpProtocols.Http2;
                    var cert = new X509Certificate2("localhost.pfx", "test");

                    listenOptions.UseHttps(cert);                    
                });
            });                   

            webBuilder.UseStartup<Startup>();
        });

I have a pfx file generated this way:

openssl req -new -x509 -newkey rsa:2048 -keyout localhost.key -out localhost.cer -days 365 -subj /CN=localhost
openssl pkcs12 -export -out localhost.pfx -inkey localhost.key -in localhost.cer