Usability with TLS trust anchors about tonic

[jen20]

I think we should definitely expose a way to make this simpler - I'll take a look into some of the options and have a think about what could be done.

[jen20]

Hi @xmclark! Personally I think I'd tend towards option 1 here. I can likely put together a pull request for this fairly quickly, as I have some other work in flight for TLS bits.

[LucioFranco]

This is a really good question! So most gRPC examples I've seen have their own ca roots so I have not really seen users require this but I think its something we might be able to support. I'm not opposed to adding an additional feature flag around adding default roots. So I believe the webpki_roots::TLS_SERVER_ROOTS is actually just the mozilla one, where as I believe with openssl you can probe the system for its certs. I'm not sure if we should expose this as a builder since they can vary? I'm not the biggest expert on TLS so not sure what the right path is.

@jen20 any thoughts?

[xmclark]

I spent some time this week to learn a bit about TLS and certificate trust chains. I found the docs at Let's Encrypt to be super useful!
https://letsencrypt.org/certificates/

It's now a little more clear now that rustls::RootCertStore::add_server_trust_anchors is simply adding the Mozilla root certificates to the TLS config. This can also be achieved by downloading the certificates from Mozilla and adding them with ClientTlsConfig::ca_certificate. That solution also works for both OpenSSL and Rustls TLS configs.

I am guessing GRPC community feels pretty comfortable with these certs because they keep updated the Mozilla root certificates in their git repo. I asked around in the GRPC gitter and I think they simply bake in the certs to the GRPC libraries. This is useful when running on an OS like windows where there is no standard location for trusted certs.
https://github.com/grpc/grpc/tree/master/etc

I think it may be useful to either:

1. expose a featureflag-gated method for adding the mozilla root certs
   Or
2. Offering a simple example for how to add the root certs

Either option would address the basic needs for users like me, and any users who care about initialization cost or root certs wouldn't need to pay the cost by default.

[LucioFranco]

Option one sounds like a great idea!

[xmclark]

Super happy to see #114 opened. I pointed my current grpc project using tonic to the jen20/tls-trust-roots branch and it works beautifully using ClientTlsConifg::add_trust_anchors!

I don't mind tonic paying the extra cost of importing the mozilla certs for rustls usage. I think most other grpc libraries do this by default anyways.

[xmclark]

I just saw announcement for rustls-native-certs. This may be something else to consider. It has cross platform support.

https://github.com/ctz/rustls-native-certs

[LucioFranco]

Oh very nice! @jen20 happy with what ever you think we should go with

[jen20]

I'll update #114 to use the native certs crates, that is likely a more appropriate option than simply relying on the Mozilla roots.

[LucioFranco]

@xmclark this should be fixed with #114, feel free to reopen if there are any more issues.