如何在 gRPC 和 ASP Net Core 3.0 中使用 ssl 证书？

Question

I am rtying to configure the service to use a SSL certificate. I have read this post:

How to enable server side SSL for gRPC?

I guess this is the main code:

var cacert = File.ReadAllText(@"ca.crt");
var servercert = File.ReadAllText(@"server.crt");
var serverkey = File.ReadAllText(@"server.key");
var keypair = new KeyCertificatePair(servercert, serverkey);
var sslCredentials = new SslServerCredentials(new List<KeyCertificatePair>() { keypair }, cacert, false);

var server = new Server
{
    Services = { GrpcTest.BindService(new GrpcTestImpl(writeToDisk)) },
    Ports = { new ServerPort("0.0.0.0", 555, sslCredentials) }
};
server.Start();

The problem is that in my case, I don't start the service in this way, I am using kestrel, and the code is this:

public static IHostBuilder CreateHostBuilder(string[] args) =>
    Host.CreateDefaultBuilder(args)
        .ConfigureWebHostDefaults(webBuilder =>
        {
            webBuilder.ConfigureKestrel(options =>
            {
                System.Net.IPAddress miAddress = System.Net.IPAddress.Parse("x.x.x.x");
                //options.Listen(miAddress, 5001, o => o.Protocols = HttpProtocols.Http2);

                options.Listen(miAddress, 5001, l =>
                {
                    l.Protocols = HttpProtocols.Http2;
                    l.UseHttps();
                    });
            });
            webBuilder.UseStartup<Startup>();
        });

In this case, I don't have access to SslCredentials, so I can't create a new one.

How could I configure my ssl certificate using kestrel?

Thanks.

Answer 1

The post you linked to is for Grpc.Core, the grpc-dotnet implementation is configured differently.

This documentation and example should help: https://github.com/grpc/grpc-dotnet/blob/dd72d6a38ab2984fd224aa8ed53686dc0153b9da/testassets/InteropTestsWebsite/Program.cs#L55

https://docs.microsoft.com/en-us/aspnet/core/grpc/authn-and-authz?view=aspnetcore-3.1

(in another words, you can configure the certificates on the server side exactly the same way as you would for any other HTTP/2 server - there's nothing grpc specific in configuring the secure connections in ASP.NET Core).

Answer 2

looks like you mistake authentication by certificates for SSL-data-encryption. In case you just want to encrypt the data channel, best to use Kestrel like:

   public static IHostBuilder CreateHostBuilder(string[] args) =>
    Host.CreateDefaultBuilder(args)
    .ConfigureWebHostDefaults(builder =>
    {
        builder.ConfigureKestrel(options =>
        {
            options.Listen(IPAddress.Loopback, 5005, configure => { configure.UseHttps(); configure.Protocols = HttpProtocols.Http2; });
        });
    });

The call to UseHttps() uses the ASP.NET Core's trusted Development certificate.

If you want to provide one yourself, use ie (or the other overloads):

public static ListenOptions UseHttps(this ListenOptions listenOptions, X509Certificate2 serverCertificate)