nleiva

// Listener
lis = manager.Listener()

if err = http.Serve(lis, grpcHandlerFunc(s, httpsHandler())); err != nil {
	log.Fatalf("failed to serve: %v", err))
}

nleiva

func grpcHandlerFunc(g *grpc.Server, h http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		ct := r.Header.Get("Content-Type")
		if r.ProtoMajor == 2 && strings.Contains(ct, "application/grpc") {
			g.ServeHTTP(w, r)
		} else {
			h.ServeHTTP(w, r)
		}
	})
}

nleiva

// Client
config := &tls.Config{}

conn, err := grpc.Dial(address, grpc.WithTransportCredentials(credentials.NewTLS(config)))
if err != nil {
	log.Fatalf("did not connect: %v", err)
}
defer conn.Close()

nleiva

manager := autocert.Manager{
	Prompt:     autocert.AcceptTOS,
	Cache:      autocert.DirCache("golang-autocert"),
	HostPolicy: autocert.HostWhitelist(host),
	Email:      "[email protected]",
}

nleiva

// Client
// ... as in http://bit.ly/go-grpc-tls-ca ...

// Server
tlsConfig := &tls.Config{
  GetCertificate: c.GetCertificate,
}

s := grpc.NewServer(grpc.Creds(credentials.NewTLS(tlsConfig)))
// ... register gRPC services ...

nleiva

c := &certify.Certify{
	CommonName:  "localhost",
	Issuer:      issuer,
	Cache:       certify.NewMemCache(),
	CertConfig:  &cfg,
	RenewBefore: 24 * time.Hour,
	Logger:      kit.New(logger),
}

nleiva

cfg := certify.CertConfig{
	SubjectAlternativeNames: []string{"localhost"},
	IPSubjectAlternativeNames: []net.IP{
		net.ParseIP("127.0.0.1"),
		net.ParseIP("::1"),
	},
	KeyGenerator: RSA{bits: 2048},
}

nleiva

issuer := &vault.Issuer{
	URL: &url.URL{
		Scheme: "https",
		Host:   "localhost:8200",
	},
	TLSConfig: &tls.Config{
		RootCAs: cp,
	},
	Token: getenv("TOKEN"),
	Role:  "my-role",

nleiva

syntax = "proto3";

package test;

service gUMI {
  rpc GetByID (GetByIDRequest) returns (User);
}

message GetByIDRequest {
  uint32 id = 1;

nleiva

type Certificate struct {
  ...
  Signature          []byte
  SignatureAlgorithm SignatureAlgorithm
  
  PublicKeyAlgorithm PublicKeyAlgorithm
  PublicKey          interface{}

  Version             int
  SerialNumber        *big.Int