Update client cert without downtime

[fabmade]

Hi together,

is it possible to reload the client cert without downtime? On server side it is possible with the tls.Config’s GetCertificate method.

grpc.DialContext(...,
  grpc.WithTransportCredentials(
    credentials.NewTLS(tls.Config{GetCertificate: myGetCertFunc, ...})))

But on client side i found no way to do this. It calls the handshake before GetCertificate or GetClientCertificate is called.

[arvindbr8]

Hey @fabmade, yes this is possible by setting a IdentityProvider in advancedTLS option when creating TLS credentials for calling Dial(). The provider will create a watcher for the cert + key files which would trigger update when for file updates. Here's an example

// specify cert + key file here (optionally set refresh duration. default: 1 hr)
clientIdentityOptions := pemfile.Options{
	CertFile:        clientCertFilename,
	KeyFile:         clientKeyFilename,
	RefreshDuration: credRefreshingInterval,
}

// create new IdentityProvider passing in Options
clientIdentityProvider, err := pemfile.NewProvider(clientIdentityOptions)

// pass in clientIdentityProvider to IdentityOption in client options
clientOptions := &ClientOptions{
	IdentityOptions: IdentityCertificateOptions{
		IdentityProvider: clientIdentityProvider,
	},
	...
}

// create credentials
clientTLSCreds, err := advancedtls.NewClientCreds(clientOptions)


// Make a connection using the credentials.
conn, err := grpc.Dial(address, grpc.WithTransportCredentials(clientTLSCreds))

Also you could check out the example from advancedTLS in our repo here

Let us know if this helps

[github-actions]

This issue is labeled as requiring an update from the reporter, and no update has been received after 6 days. If no update is provided in the next 7 days, this issue will be automatically closed.

[fabmade]

@arvindbr8 perfect, thank you very much for your help!