Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-126588

Difficulty in configuring Qt gRPC client for TLS connection to server

XMLWordPrintable

    • Icon: Suggestion Suggestion
    • Resolution: Fixed
    • Icon: P2: Important P2: Important
    • None
    • 6.6.2
    • GRPC
    • None
    • Linux/Yocto
    • 01a6a2258 (dev), 9410fe307 (6.8), 09af2887d (6.7)

      Here is a thread that I found: https://forum.qt.io/topic/156171/create-a-secure-grpc-channel-without-specifying-certificates/10

       

      I have a grpc service in AWS which is exposed via a load balancer. The TLS termination happens at the load balancer level. I am able to hit the service with grpcurl and postman and a client golang app.

       

      For the client, we need to enable ssl for calling this service otherwise we get "Connection closed" and status of "Unavailable". In my particular setup, the server will not authenticate or validate a client's certificate and the load balancer listener looks for grpc/http2 requests.

       

      After a lot of toiling, I needed to set the QSslConfiguration's setAllowedNextProtocols({ "h2" }). This setting is crucial for establishing a secure gRPC connection, but it's not immediately obvious or well-documented for gRPC use cases.

       

      To enhance developer experience and reduce potential configuration errors, consider one of the following:

      1. Add a defaultGrpcConfiguration() method to QSslConfiguration.
      2. Enhance QGrpcChannelOptions to automatically set appropriate SSL configurations for gRPC.
      3. Improve documentation to clearly highlight the necessary SSL settings for gRPC connections, especially the requirement for "h2" in allowed next protocols. I'm sure enterprise customers will need this.

       

      P.S: it would be nice if Qt would craft better API's to avoid leaky abstractions

      Hope this helps.

        For Gerrit Dashboard: QTBUG-126588
        # Subject Branch Project Status CR V

            semlanik Alexey Edelev
            talksik Arjun Patel
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved:

                There are no open Gerrit changes