notmedia’s gists

notmedia / grpc-client-mutual-tls.ts

Created August 29, 2022 17:36

	function getChannelCredentials(): ChannelCredentials {
	const rootCert = fs.readFileSync(path.resolve(__dirname, '../certs/ca-cert.pem'));
	const clientCert = fs.readFileSync(path.resolve(__dirname, '../certs/client-cert.pem'));
	const clientKey = fs.readFileSync(path.resolve(__dirname, '../certs/client-key.pem'));

	const channelCredentials = ChannelCredentials.createSsl(rootCert, clientKey, clientCert);

	return channelCredentials;
	}

notmedia / grpc-client-server-tls.ts

Last active August 29, 2022 17:33

	import { ChannelCredentials } from '@grpc/grpc-js';
	import * as fs from 'fs';
	import * as path from 'path';

	import { TLSServiceClient } from './generated/proto/tls_service';

	function getChannelCredentials(): ChannelCredentials {
	const rootCert = fs.readFileSync(path.resolve(__dirname, '../certs/ca-cert.pem'));

	// If you use CA root certificate

notmedia / docker-compose-envoy-grpc-mutual-tls.yaml

Created August 29, 2022 16:11

	services:
	envoy-mutual:
	image: envoyproxy/envoy:v1.22.0
	ports:
	- 8080:8080
	volumes:
	- ./envoy-mutual.yaml:/etc/envoy/envoy.yaml:ro
	- ./certs/ca-cert.pem:/etc/ca-cert.pem
	- ./certs/server-cert.pem:/etc/server-cert.pem
	- ./certs/server-key.pem:/etc/server-key.pem

notmedia / docker-compose-envoy-grpc-server-side-tls.yaml

Created August 29, 2022 16:08

	services:
	envoy-server:
	image: envoyproxy/envoy:v1.22.0
	ports:
	- 8080:8080
	volumes:
	- ./envoy-server.yaml:/etc/envoy/envoy.yaml:ro
	- ./certs/server-cert.pem:/etc/server-cert.pem
	- ./certs/server-key.pem:/etc/server-key.pem

notmedia / envoy-grpc-mutual-tls.yaml

Created August 29, 2022 16:03

	static_resources:
	listeners:
	- name: listener_0
	address:
	socket_address: { address: 0.0.0.0, port_value: 8080 }
	filter_chains:
	- filters:
	- name: envoy.filters.network.http_connection_manager
	typed_config:
	"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager

notmedia / envoy-grpc-server-side-tls.yaml

Created August 29, 2022 16:02

	static_resources:
	listeners:
	- name: listener_0
	address:
	socket_address: { address: 0.0.0.0, port_value: 8080 }
	filter_chains:
	- filters:
	- name: envoy.filters.network.http_connection_manager
	typed_config:
	"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager

notmedia / grpc-mutual-tls.ts

Last active August 29, 2022 15:17

	function getServerCredentials(): ServerCredentials {
	const rootCert = fs.readFileSync(path.resolve(__dirname, '../certs/ca-cert.pem'));
	const serverCert = fs.readFileSync(path.resolve(__dirname, '../certs/server-cert.pem'));
	const serverKey = fs.readFileSync(path.resolve(__dirname, '../certs/server-key.pem'));

	const serverCredentials = ServerCredentials.createSsl(
	rootCert,
	[
	{
	cert_chain: serverCert,

notmedia / grpc-server-tls.ts

Created August 29, 2022 15:11

	import { Server, ServerCredentials } from '@grpc/grpc-js';
	import * as fs from 'fs';
	import * as path from 'path';

	import { TLSServiceServer, TLSServiceService } from './generated/proto/tls_service';

	const TLSService: TLSServiceServer = {
	unary(call, callback) {
	callback(null, call.request);
	},

notmedia / tls_service.proto

Created August 29, 2022 13:48

tls_service.proto

	syntax = "proto3";

	package tls_service.v1;

	message SimpleMessage {
	string id = 1;
	}

	service TLSService {
	rpc Unary(SimpleMessage) returns (SimpleMessage);

notmedia / gen-certs.sh

Last active October 2, 2024 05:26

Creating Self-Signed certificates

	rm *.pem
	rm *.srl
	rm *.cnf

	# 1. Generate CA's private key and self-signed certificate
	openssl req -x509 -newkey rsa:4096 -days 365 -nodes -keyout ca-key.pem -out ca-cert.pem -subj "/C=FR/ST=Occitanie/L=Toulouse/O=Test Org/OU=Test/CN=*.test/[email protected]"

	echo "CA's self-signed certificate"
	openssl x509 -in ca-cert.pem -noout -text

Alexey Vasyukov notmedia