Disabling certificate check in gRPC TLS

Question

Currently, I have a ngnix server (on port 5001) behind which a gRPC server is running, nginx having TLS enabled. All gRPC clients need to send the request to nginx port which forwards to gRPC server running. Initially for testing had gRPC request using usePlaintext() and it all worked fine, but the end goal is to use TLS. The requirement here is (as this are internal applications), gRPC channel request need not pass certificate but do a "skip certificate" when creating the channel. After Googling around, I found examples on TLS but all of them does take .cert, .key file. Below is snippet which i tried and it failed at the server end couldn't validate the certificate

 (java code)              
ManagedChannel channel = NettyChannelBuilder.forAddress(<server IP address>, 5001).sslContext(GrpcSslContexts.forClient().trustManager
                                (new File(<.cert file>).build())
                        .build();

Doing some more research, i see Golang has InsecureSkipVerify() using which i can skip ceritifcate check (pls correct me if i am wrong)

tc := credentials.NewTLS(&tls.Config{
                InsecureSkipVerify: true,
            })

Now how do I accomplish the same in java?

Mishap

Answer 1

TLS with disabled certificate checking is of questionable usefulness because it can be trivially MITMed and so is not "supported" by gRPC. I highly recommend providing the client with proper root certificates to verify the server.

That said, you can go around gRPC's API to do this by passing Netty's InsecureTrustManagerFactory to SslContextBuilder.trustManager(TrustManagerFactory):

NettyChannelBuilder.forAddress("<server IP address>", 5001)
    .sslContext(GrpcSslContexts.forClient()
      .trustManager(InsecureTrustManagerFactory.INSTANCE)
      .build())
    .build();

Monophonic

Thanks for the reply. When I try to use InsecureTrustManagerFactory() it says private access so does this mean there is some getter() method for this? Is this singleton even then shouldn't it allow me to create a new object? Also i read some blogs which says we cannot use SslContextBuilder() but only use GrpcSslContexts(), in such cases does this support InsecureTrustManagerFactory()? I am using the following import io.netty.handler.ssl.util.InsecureTrustManagerFactory; is this correct? Sorry if it's very basic. – Mishap

Was able to figure it out. Did the following InsecureTrustManagerFactory.INSTANCE. With this change, it works. Thanks Eric for pointing about InsecureTrustManagerFactory. – Mishap

Is there any such way for Grpc node library. I am continuously getting : E0127 14:52:05.495000000 9988 ssl_transport_security.cc:1245] Handshake failed with fatal error SSL_ERROR_SSL: error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED. – Factotum

@SukhvirSingh do u have the solution for nodejs? i have the same problem going through nginx as well, even after setting server.pem and server.key – Knotting

@Eric Anderson do you know how to provide to Java io.grpc a new certificate? – Negligee