notmedia

function getChannelCredentials(): ChannelCredentials {
  const rootCert = fs.readFileSync(path.resolve(__dirname, '../certs/ca-cert.pem'));
  const clientCert = fs.readFileSync(path.resolve(__dirname, '../certs/client-cert.pem'));
  const clientKey = fs.readFileSync(path.resolve(__dirname, '../certs/client-key.pem'));

  const channelCredentials = ChannelCredentials.createSsl(rootCert, clientKey, clientCert);

  return channelCredentials;
}

notmedia

import { ChannelCredentials } from '@grpc/grpc-js';
import * as fs from 'fs';
import * as path from 'path';

import { TLSServiceClient } from './generated/proto/tls_service';

function getChannelCredentials(): ChannelCredentials {
  const rootCert = fs.readFileSync(path.resolve(__dirname, '../certs/ca-cert.pem'));
  
  // If you use CA root certificate

notmedia

services:
  envoy-mutual:
    image: envoyproxy/envoy:v1.22.0
    ports:
      - 8080:8080
    volumes:
      - ./envoy-mutual.yaml:/etc/envoy/envoy.yaml:ro
      - ./certs/ca-cert.pem:/etc/ca-cert.pem
      - ./certs/server-cert.pem:/etc/server-cert.pem
      - ./certs/server-key.pem:/etc/server-key.pem

notmedia

services:
  envoy-server:
    image: envoyproxy/envoy:v1.22.0
    ports:
      - 8080:8080
    volumes:
      - ./envoy-server.yaml:/etc/envoy/envoy.yaml:ro
      - ./certs/server-cert.pem:/etc/server-cert.pem
      - ./certs/server-key.pem:/etc/server-key.pem

notmedia

static_resources:
  listeners:
    - name: listener_0
      address:
        socket_address: { address: 0.0.0.0, port_value: 8080 }
      filter_chains:
        - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager

notmedia

static_resources:
  listeners:
    - name: listener_0
      address:
        socket_address: { address: 0.0.0.0, port_value: 8080 }
      filter_chains:
        - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager

notmedia

function getServerCredentials(): ServerCredentials {
  const rootCert = fs.readFileSync(path.resolve(__dirname, '../certs/ca-cert.pem'));
  const serverCert = fs.readFileSync(path.resolve(__dirname, '../certs/server-cert.pem'));
  const serverKey = fs.readFileSync(path.resolve(__dirname, '../certs/server-key.pem'));

  const serverCredentials = ServerCredentials.createSsl(
    rootCert,
    [
      {
        cert_chain: serverCert,

notmedia

import { Server, ServerCredentials } from '@grpc/grpc-js';
import * as fs from 'fs';
import * as path from 'path';

import { TLSServiceServer, TLSServiceService } from './generated/proto/tls_service';

const TLSService: TLSServiceServer = {
  unary(call, callback) {
    callback(null, call.request);
  },

notmedia

syntax = "proto3";

package tls_service.v1;

message SimpleMessage {
  string id = 1;
}

service TLSService {
  rpc Unary(SimpleMessage) returns (SimpleMessage);

notmedia

rm *.pem
rm *.srl
rm *.cnf

# 1. Generate CA's private key and self-signed certificate
openssl req -x509 -newkey rsa:4096 -days 365 -nodes -keyout ca-key.pem -out ca-cert.pem -subj "/C=FR/ST=Occitanie/L=Toulouse/O=Test Org/OU=Test/CN=*.test/emailAddress=test@gmail.com"

echo "CA's self-signed certificate"
openssl x509 -in ca-cert.pem -noout -text