gRPC 的 NewClientTLSFromCert 如何从公钥生成 TLS 凭证？

Question

The google.golang.org/grpc/credentials library has the following method.

// NewClientTLSFromCert constructs TLS credentials from the provided root
// certificate authority certificate(s) to validate server connections. If
// certificates to establish the identity of the client need to be included in
// the credentials (eg: for mTLS), use NewTLS instead, where a complete
// tls.Config can be specified.
// serverNameOverride is for testing only. If set to a non empty string,
// it will override the virtual host name of authority (e.g. :authority header
// field) in requests.
func NewClientTLSFromCert(cp *x509.CertPool, serverNameOverride string) TransportCredentials {
    return NewTLS(&tls.Config{ServerName: serverNameOverride, RootCAs: cp})
}

I am confused about how it can generate TLS credentials from a public key (the certificate here).

How will this work? If I generate credentials from a public cert, why would it be accepted on the server side whose TLS cert has been signed with the private key of the TLS CA?

What exactly happens here and how is the connection secured over here?

Answer 1

Transport "credentials" in gRPC are fully responsible for the handshake with the client/server. That means they include configuration other than just "credentials" like private keys and other secrets. For TLS here, it includes the root trust certificates to use when verifying the server's certificate. You can think of it as just "TLS configuration."