Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: Self-issue Internet PKI certificate for gRPC server #44

Merged
merged 12 commits into from
May 8, 2020
Merged

fix: Self-issue Internet PKI certificate for gRPC server #44

merged 12 commits into from
May 8, 2020

Conversation

gnarea
Copy link
Member

@gnarea gnarea commented May 5, 2020 •
edited
Loading

Fixes #36

Adding Bouncy Castle introduces many Lint violation warnings like:

Error processing /home/gus/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcpkix-jdk15on/1.65/c9507d93e4b453320b57d9ac21bdd67d65a00bbc/bcpkix-jdk15on-1.65.jar:META-INF/versions/9/module-info.class: broken class file? (This feature requires ASM6)
Error processing /home/gus/.gradle/caches/modules-2/files-2.1/org.bouncycastle/bcprov-jdk15on/1.65/320b989112f00a63a3bcfa5a98f31a4f865a20fa/bcprov-jdk15on-1.65.jar:META-INF/versions/11/org/bouncycastle/jcajce/provider/asymmetric/edec/KeyFactorySpi.class: broken class file? (This feature requires ASM7)

There are a bunch of solutions here: https://stackoverflow.com/questions/60598110/meta-inf-versions-9-module-info-class-broken-class-file-this-feature-requires -- any preference? I don't like any -- it seems like a matter of picking a poison.

@gnarea gnarea self-assigned this May 5, 2020
@gnarea gnarea marked this pull request as ready for review May 5, 2020 18:31
@gnarea gnarea requested a review from sdsantos May 5, 2020 18:39
@gnarea
Copy link
Member Author

gnarea commented May 6, 2020 •
edited
Loading

In addition to the changes requested, I also implemented a change to use the correct IP address when issuing the certificate instead of the hardcoded 192.168.43.1. This way, gRPC clients won't have to use grpc.ssl_target_name_override, which would require the client to download the certificate before starting the connection so they can extract the IP address used in the certificate.

See: 4e902ca. I'd appreciate your feedback on that change too.

sdsantos
sdsantos previously approved these changes May 7, 2020
View reviewed changes
app/src/main/java/tech/relaycorp/cogrpc/server/Networking.kt Outdated Show resolved Hide resolved
sdsantos
sdsantos previously approved these changes May 7, 2020
View reviewed changes
@gnarea
Copy link
Member Author

gnarea commented May 8, 2020

@sdsantos, I had to make a change after the rebase (541252d). Can you please check it out when you get a chance?

I hate having to use an external dependency just to do base64 encoding so I'm seriously considering switching to the raw binary serialisation in the near future (AwalaApp/specs#61).

@gnarea gnarea merged commit a8284c9 into master May 8, 2020
@gnarea gnarea deleted the tls-cert branch May 8, 2020 09:48
@github-actions
Copy link

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sdsantos sdsantos sdsantos approved these changes

Assignees

@gnarea gnarea

Labels
released
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Self-issue Internet PKI certificate for gRPC server
2 participants
@gnarea @sdsantos