nleiva

// Client
config := &tls.Config{
	InsecureSkipVerify: false,
}
conn, err := grpc.Dial(address, grpc.WithTransportCredentials(credentials.NewTLS(config)))
if err != nil {
	log.Fatalf("did not connect: %v", err)
}
defer conn.Close()

nleiva

// Client
b, _ := ioutil.ReadFile("ca.cert")
cp := x509.NewCertPool()
if !cp.AppendCertsFromPEM(b) {
	return nil, errors.New("credentials: failed to append certificates")
}
config := &tls.Config{
	InsecureSkipVerify: false,
	RootCAs:            cp,
}

nleiva

// Client
creds, err := credentials.NewClientTLSFromFile("service.pem", "")
if err != nil {
	log.Fatalf("could not process the credentials: %v", err)
}
conn, err := grpc.Dial(address, grpc.WithTransportCredentials(creds))
if err != nil {
	log.Fatalf("did not connect: %v", err)
}
defer conn.Close()

nleiva

type Certificate struct {
  ...
  Signature          []byte
  SignatureAlgorithm SignatureAlgorithm
  
  PublicKeyAlgorithm PublicKeyAlgorithm
  PublicKey          interface{}

  Version             int
  SerialNumber        *big.Int

nleiva

syntax = "proto3";

package test;

service gUMI {
  rpc GetByID (GetByIDRequest) returns (User);
}

message GetByIDRequest {
  uint32 id = 1;

nleiva

issuer := &vault.Issuer{
	URL: &url.URL{
		Scheme: "https",
		Host:   "localhost:8200",
	},
	TLSConfig: &tls.Config{
		RootCAs: cp,
	},
	Token: getenv("TOKEN"),
	Role:  "my-role",

nleiva

cfg := certify.CertConfig{
	SubjectAlternativeNames: []string{"localhost"},
	IPSubjectAlternativeNames: []net.IP{
		net.ParseIP("127.0.0.1"),
		net.ParseIP("::1"),
	},
	KeyGenerator: RSA{bits: 2048},
}

nleiva

c := &certify.Certify{
	CommonName:  "localhost",
	Issuer:      issuer,
	Cache:       certify.NewMemCache(),
	CertConfig:  &cfg,
	RenewBefore: 24 * time.Hour,
	Logger:      kit.New(logger),
}

nleiva

// Client
// ... as in http://bit.ly/go-grpc-tls-ca ...

// Server
tlsConfig := &tls.Config{
  GetCertificate: c.GetCertificate,
}

s := grpc.NewServer(grpc.Creds(credentials.NewTLS(tlsConfig)))
// ... register gRPC services ...

nleiva

manager := autocert.Manager{
	Prompt:     autocert.AcceptTOS,
	Cache:      autocert.DirCache("golang-autocert"),
	HostPolicy: autocert.HostWhitelist(host),
	Email:      "test@example.com",
}