go的grpc源碼中grpc.ServeHTTP可以同時提供https,但需要TLS認(rèn)證
// ServeHTTP implements the Go standard library's http.Handler
// interface by responding to the gRPC request r, by looking up
// the requested gRPC method in the gRPC server s.
//
// The provided HTTP request must have arrived on an HTTP/2
// connection. When using the Go standard library's server,
// practically this means that the Request must also have arrived
// over TLS.
//
// To share one port (such as 443 for https) between gRPC and an
// existing http.Handler, use a root http.Handler such as:
//
// if r.ProtoMajor == 2 && strings.HasPrefix(
// r.Header.Get("Content-Type"), "application/grpc") {
// grpcServer.ServeHTTP(w, r)
// } else {
// yourMux.ServeHTTP(w, r)
// }
//
// Note that ServeHTTP uses Go's HTTP/2 server implementation which is totally
// separate from grpc-go's HTTP/2 server. Performance and features may vary
// between the two paths. ServeHTTP does not support some gRPC features
// available through grpc-go's HTTP/2 server.
//
好吧溪北，接著首先用openssl創(chuàng)建EC參數(shù)和私鑰文件
#客戶端
openssl genrsa -out ca.key 2048
openssl req -x509 -new -nodes -key ca.key -subj "/CN=tim" -days 5000 -out ca.crt
#服務(wù)端
openssl genrsa -out server.key 2048
openssl req -new -key server.key -subj "/CN=tim" -out server.csr
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 5000
openssl .png
這里需要記錄一下Common Name輸入的內(nèi)容top
ls.png
#server 端
certFile: ./server.crt
keyFile: ./server.key
#client端
ca.crt
開始修改代碼,服務(wù)端
//創(chuàng)建tls認(rèn)證。YamlConfig.CertFile指生成的server.pem路徑市框，YamlConfig.KeyFile指生成的server.key路徑
cred, err := credentials.NewServerTLSFromFile(YamlConfig.CertFile, YamlConfig.KeyFile)
if err != nil {
log.Fatalln(err)
}
grpcServer := grpc.NewServer(
grpc.Creds(cred), //這里加載了tls認(rèn)證
grpc.UnaryInterceptor(grpcMetrics.UnaryServerInterceptor()),
)
··········
log.Println("Listen ",YamlConfig.Port)
//http也加載tls
if err = http.ListenAndServeTLS(
fmt.Sprintf("%s", YamlConfig.Port),
YamlConfig.CertFile,
YamlConfig.KeyFile,
http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if r.ProtoMajor == 2 && strings.HasPrefix(
r.Header.Get("Content-Type"), "application/grpc") {
grpcServer.ServeHTTP(w, r)
} else {
mux.ServeHTTP(w, r)
}
return
}),
);err != nil{
log.Fatalln(err)
}
然后是客戶端
//CertFile指server.pem路徑
cred,err := credentials.NewClientTLSFromFile(CertFile,"top")
if err != nil {
log.Fatalln("Failed to create TLS credentials %v", err)
}
conn, err := grpc.DialContext(ctx, v.(string),
grpc.WithBlock(),
grpc.WithTransportCredentials(cred),//使用tls
grpc.WithKeepaliveParams(keepalive.ClientParameters{
Time: 10 * time.Second,
Timeout: 100 * time.Millisecond,
PermitWithoutStream: true}),
)
瀏覽器訪問https://xxx 沒問題
grpc&&https.png
grpc_client客戶端調(diào)grpc_server沒問題
grpc_client->grpc_server
