Using AdvancedTlsX509TrustManager and AdvancedTlsX509KeyManager

[sancheztavo]

Hello!

Could anyone point me to the most straightforward way of using AdvancedTlsX509TrustManager and AdvancedTlsX509KeyManager when using grpc-spring ?

I need it for the server automatically reloading the certificates and keys.

[sancheztavo]

In the end I added the following to the Configuration:

private final ScheduledExecutorService keyAndCertificateReloadExecutorService = Executors.newSingleThreadScheduledExecutor();

@Bean
@ConditionalOnProperty(name = "grpc.server.security.enabled", havingValue = "true")
public GrpcServerConfigurer keyAndCertificateReloadinGrpcServerConfigurer(GrpcServerProperties properties)
        throws IOException, GeneralSecurityException {
    AdvancedTlsX509KeyManager keyManager = new AdvancedTlsX509KeyManager();

    // ignore the autocloseable return value as close() is only used to stop reloading certificates
    keyManager.updateIdentityCredentialsFromFile(properties.getSecurity().getPrivateKey().getFile(),
            properties.getSecurity().getCertificateChain().getFile(), 1, TimeUnit.MINUTES,
            keyAndCertificateReloadExecutorService);

    SslContext sslContext = GrpcSslContexts.configure(SslContextBuilder.forServer(keyManager)).build();

    return serverBuilder -> {
        if (serverBuilder instanceof NettyServerBuilder) {
            ((NettyServerBuilder) serverBuilder).sslContext(sslContext).build();
        }
    };
}

Since in my case both the key and certificates are updated periodically at the same time, I don't need the AdvancedTlsX509TrustManager, AdvancedTlsX509KeyManager will reload both.

Let me know if there is a better way of doing this.