如何在 Python/C++ 的 gRPC 客户端中设置 TLS/SNI 选项? [英] How to set TLS/SNI option in gRPC client of Python/C++?

问题描述

如何设置 TLS/SNI (https://en.wikipedia.org/wiki/Server_Name_Indication) 在 Python/C++ gRPC 客户端 API 中?

How do I set the TLS/SNI (https://en.wikipedia.org/wiki/Server_Name_Indication) in the Python/C++ gRPC client API?

换句话说，在openssl s_client中设置-servername的等价物是什么?

In other words, what's the equivalent of setting the -servername in openssl s_client?

我已经通过使用 openssl s_client 上的正确标志验证了我的 TLS 服务器:

I have verified my TLS server works by using the correct flags on openssl s_client:

 openssl s_client -connect "myserver.tunnel.dev:4443" -servername "myserver.tunnel.dev" 

但是，我无法使用 Python/C++ API 正确设置凭据:

However, I wasn't able to setup the credentials correct with the Python /C++ API:

uri = "myserver.tunnel.dev:4443"
hostname = "myserver.tunnel.dev"

creds = grpc.ssl_channel_credentials(
    root_certificates=dev_cert)
    # root_certificates=certificate_chain)
    # certificate_chain=certificate_chain)
channel = grpc.secure_channel(uri, creds,
    options=(('grpc.ssl_target_name_override', hostname),)
)

这会抛出:

grpc._channel._Rendezvous: <_Rendezvous of RPC that terminated with (StatusCode.UNAVAILABLE, Connect Failed)>

在 结构，我能找到的最接近的选项是 ssl_target_name_override，它也不起作用.

推荐答案

设置 options=(('grpc.ssl_target_name_override', hostname),) 应该可以工作.这是覆盖主机名的正确方法.在这种情况下，这似乎没有必要，因为您的 uri 主机和覆盖主机是相同的.您可以使用 此处 并查看握手是否失败或是否有其他原因导致连接失败.

Setting options=(('grpc.ssl_target_name_override', hostname),) should work. This is the right way to override host name. In this case, it seems unnecessary as your uri host and override host are the same. You could turn on some tracing by using the environment variables listed here and see if the handshake is failing or the is there some other reason for connection failure.

这篇关于如何在 Python/C++ 的 gRPC 客户端中设置 TLS/SNI 选项?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！