grpc中的安全连接

Question

I have issues in connecting to my server using gRPC. The server uses certificate files(rpc.cert and rpc.key) to authenticate but i do not know how to include those files. Currently this is the code i use to connect

ManagedChannel channel = OkHttpChannelBuilder.forAddress("127.0.0.1", 9111)
.usePlaintext(true)
.build();

Using the above code throws this error

io.grpc.StatusRuntimeException: UNAVAILABLE: End of stream or IOExceptio
    at io.grpc.stub.ClientCalls.toStatusRuntimeException(ClientCalls.jav
    at io.grpc.stub.ClientCalls.getUnchecked(ClientCalls.java:202)
    at io.grpc.stub.ClientCalls.blockingUnaryCall(ClientCalls.java:131)
    at com.dcrwallet.grpc.WalletLoaderServiceGrpc$WalletLoaderServiceBlo
    at com.decrediton.MainActivity$2.onClick(MainActivity.java:86)
    at android.view.View.performClick(View.java:5675)
    at android.view.View$PerformClick.run(View.java:22641)
    at android.os.Handler.handleCallback(Handler.java:836)
    at android.os.Handler.dispatchMessage(Handler.java:103)
    at android.os.Looper.loop(Looper.java:203)
    at android.app.ActivityThread.main(ActivityThread.java:6285)
    at java.lang.reflect.Method.invoke(Native Method)
    at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(Zygote
    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:924)
Caused by: javax.net.ssl.SSLHandshakeException: Handshake failed
    at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:444)
    at io.grpc.okhttp.OkHttpProtocolNegotiator.negotiate(OkHttpProtocolNegotiator.java:93)
    at io.grpc.okhttp.OkHttpProtocolNegotiator$AndroidNegotiator.negotiate(OkHttpProtocolNegotiator.java:159)
    at io.grpc.okhttp.OkHttpTlsUpgrader.upgrade(OkHttpTlsUpgrader.java:63)
    at io.grpc.okhttp.OkHttpClientTransport$1.run(OkHttpClientTransport.java:429)
    at io.grpc.internal.SerializingExecutor.run(SerializingExecutor.java:123)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1133)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:607)
    at java.lang.Thread.run(Thread.java:761)
Caused by: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0xb036ce80: Failure in SSL library, usually a protocol error error:1000006b:SSL routines:OPENSSL_internal:BAD_ECC_CERT (external/boringssl/src/ssl/s3_clnt.c:957 0xa74a5d15:0x00000000)
    at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
    at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:362)

I cannot find any documentation on using grpc okhttp in android. The gRPC documentation by google does not include that so i pretty much don't know what to do about the error.Thanks

Answer 1

Since the server expects TLS, you can't use plaintext. Normally, you don't need to do anything; grpc-java Channels default to using TLS:

ManagedChannel channel = OkHttpChannelBuilder.forAddress("127.0.0.1", 9111)
  .sslSocketFactory(yourSslSocketFactory)
  .build();

The client doesn't need any files to identify the server because the server's certificate should be signed by a trusted Certificate Authority (CA). It's unclear by your question if this is the case though. If you are using a self-signed certificate or a custom CA to sign the certificate then SSLSocketFactory.getDefault() , which grpc-okhttp uses by default, likely will not accept the server's certificate.

In that rarer case, you will need to specify an SSLSocketFactory for gRPC to use:

ManagedChannel channel = OkHttpChannelBuilder.forAddress("127.0.0.1", 9111)
  .sslSocketFactory(yourSslSocketFactory)
  .build();

You would need to include a certificate in the client binary and the yourSslSocketFactory would need to reference that certificate for it's TrustManager . As an example (taken from some grpc tests ):

KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
ks.load(null, null);
CertificateFactory cf = CertificateFactory.getInstance("X.509");
Certificate cert = cf.generateCertificate(theRawCert);
ks.setCertificateEntry("customca", cert);

TrustManagerFactory trustManagerFactory =
    TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
trustManagerFactory.init(ks);
SSLContext context = SSLContext.getInstance("TLS", provider);
context.init(null, trustManagerFactory.getTrustManagers(), null);
return context.getSocketFactory();