-
Suggestion
-
Resolution: Fixed
-
P2: Important
-
None
-
6.6.2
-
None
-
-
01a6a2258 (dev), 9410fe307 (6.8), 09af2887d (6.7)
Here is a thread that I found: https://forum.qt.io/topic/156171/create-a-secure-grpc-channel-without-specifying-certificates/10
I have a grpc service in AWS which is exposed via a load balancer. The TLS termination happens at the load balancer level. I am able to hit the service with grpcurl and postman and a client golang app.
For the client, we need to enable ssl for calling this service otherwise we get "Connection closed" and status of "Unavailable". In my particular setup, the server will not authenticate or validate a client's certificate and the load balancer listener looks for grpc/http2 requests.
After a lot of toiling, I needed to set the QSslConfiguration's setAllowedNextProtocols({ "h2" }). This setting is crucial for establishing a secure gRPC connection, but it's not immediately obvious or well-documented for gRPC use cases.
To enhance developer experience and reduce potential configuration errors, consider one of the following:
- Add a defaultGrpcConfiguration() method to QSslConfiguration.
- Enhance QGrpcChannelOptions to automatically set appropriate SSL configurations for gRPC.
- Improve documentation to clearly highlight the necessary SSL settings for gRPC connections, especially the requirement for "h2" in allowed next protocols. I'm sure enterprise customers will need this.
P.S: it would be nice if Qt would craft better API's to avoid leaky abstractions
Hope this helps.