Handshake fails with Go gRPC server (EOF)

[stevenroose]

I have a Golang gRPC server daemon: https://github.com/btcsuite/btcwallet
And I created a Dart RPC client package for it (utility): https://github.com/stevenroose/dart-btcwallet-rpc

I'm trying to make them connect as follows (btcwallet generates a certificate file for localhost):

var certFile = new File("/home/steven/.btcwallet/rpc.cert");
var cert = await certFile.readAsBytes();
var rpcUri = Uri.parse("https://localhost:9090");

_grpcChannel = new ClientChannel(rpcUri.host, port: rpcUri.port,
  options: new ChannelOptions.secure(certificate: rpcCertificate));
_grpcWalletService = new WalletServiceClient(_grpcChannel);

Calling any of the methods of _grpcWalletService returns in the following error on the server while I can't catch any exceptions on the server.

Server.Serve failed to complete security handshake from "127.0.0.1:58620": EOF

[stevenroose]

It really looks like this package is making bad requests as the server reports that it gets an EOF instead of a handshake.

[jakobr-google]

I added some more debug logging, and got this from the client:

HandshakeException: Handshake error in client (OS Error: 
	BAD_ECC_CERT(ssl_cert.c:820))

Which led me to this issue: grpc/grpc#6722 (comment)

Dart also uses BoringSSL, so this looks like the cause. The generated cert is using P-521.

I'm keeping this bug open to surface the error, and I'll see if there's something we can do about it.

[stevenroose]

Ironically the cert is generated with the Go code in the stdlib "tls" package, made by Google :)

[jakobr-google]

I don't think anyone's ever accused Google of being internally consistent. :)

I'll look into it.

[stevenroose]

I tried with different certificate that I created with openssl and it worked. So somehow it's Dart's (or Go's) SSL implementations.

[stevenroose]

@jakobr-google Now that I have your attention on certificate issues. Is it possible in gRPC (or Dart in general) to ignore the common name (CN) of the certificate? For testing, f.e. I put CN=localhost, but when developing on Flutter, I need to put my local IP address (over WiFi), so I would need to create a new certificate every time my local IP changes...

I have the same problem. Did you find a solution ?

[stevenroose]

@gedw99 I made a new SSL certificate with OpenSSL instead of one that my Go server made. It's a bug in the Dart BoringSSL implementation apparently.

Thanks. Glad it's only that :)

[jakobr-google]

Not exactly a bug in BoringSSL, more like a decision to not support P-521. We can always debate whether the merits of that decision, but there's unfortunately not much we can do on the Dart side, if BoringSSL doesn't support it.

Now, wrt. ignoring the CN, I added the option to pass a 'bad certificate handler' in #60 (released in v0.3.1), which should allow you to do that. There's also a blanket allowBadCertificates handler you can use during development to ignore all certificate errors. Please let me know if that doesn't work for you!

[tp]

I have a possibly related issue with a certificate that has X509v3 Subject Alternative Name for localhost as well as staging.company.com.

When trying to access it locally (localhost:50051) I get an error:

gRPC Error (14, Error connecting: HandshakeException: Handshake error in client (OS Error: 
        CERTIFICATE_VERIFY_FAILED: ok(handshake.cc:352)))

But the same certificate and keystore combination works fine when deployed on the staging system (on port 443 though, but I don't think that can make a difference here).

Overwriting to accept any certificate for localhost host works now (thanks to the changes in here!), but I don't see why I would have to resort to that option.

Could the 2 possibly be related or should I create a new issue? What other details would be important to provide? I can't share access to the system.