title: Java gRPC - TLS - how to set up mutual TLS on the client side?
body: <p>I work on a software application that uses gRPC to establish a bi-directional stream between client and a server.</p>
  
  <p>I'm looking for something similar to this ticket's answer only in java: <a href="https://stackoverflow.com/questions/37714558/how-to-enable-server-side-ssl-for-grpc">How to enable server side SSL for gRPC?</a></p>
  
  <p>I would like to configure my application so that they can choose what TLS scenario they want to use: </p>
  
  <p><strong>Scenario 1</strong>: plaintext (no encryption)</p>
  
  <p><strong>Scenario 2</strong>: Server-side TLS</p>
  
  <p><strong>Scenario 3</strong>: Mutual TLS</p>
  
  <p>For TLS setups, I am using Java on non-Android environments, so I will only be considering the OpenSSL installed scenario using <a href="https://github.com/grpc/grpc-java/blob/master/SECURITY.md#openssl-statically-linked-netty-tcnative-boringssl-static" rel="nofollow noreferrer">https://github.com/grpc/grpc-java/blob/master/SECURITY.md#openssl-statically-linked-netty-tcnative-boringssl-static</a></p>
  
  <p>Configuring the <strong>server side</strong> seems pretty straight forward because it is documented quite well: <a href="https://github.com/grpc/grpc-java/blob/master/SECURITY.md#mutual-tls" rel="nofollow noreferrer">https://github.com/grpc/grpc-java/blob/master/SECURITY.md#mutual-tls</a></p>
  
  <p>Here would be the steps for the corresponding TLS options:</p>
  
  <p><strong>Sever-side configuration for Scenario 1</strong>: Use <code>builder.usePlaintext</code></p>
  
  <p><strong>Sever-side configuration for Scenario 2</strong>:  Add a <code>NettyServerBuilder.sslContext</code> built by SSL Context Builder with <code>GrpcSslContexts.forServer</code> and set the <code>cert chain</code> and <code>cert key</code> (and password if needed)</p>
  
  <p><strong>Sever-side configuration for Scenario 3</strong>:  Add a <code>NettyServerBuilder.sslContext</code> built by SSL Context Builder with <code>GrpcSslContexts.forServer</code> and set the <code>cert chain</code> and <code>cert key</code> (and password if needed), and also set a <code>trustManager</code> on the sslContextBuidler set to the trust cert file.</p>
  
  <p>The server-side part is well documented which is excellent.</p>
  
  <p>Now I want to configure a <code>NettyChannelBuilder</code> on the <strong>client side</strong>. The only thing I can find information on this is in this unit test: <a href="https://github.com/grpc/grpc-java/blob/master/interop-testing/src/test/java/io/grpc/testing/integration/TlsTest.java" rel="nofollow noreferrer">https://github.com/grpc/grpc-java/blob/master/interop-testing/src/test/java/io/grpc/testing/integration/TlsTest.java</a></p>
  
  <p>Here are the configurations I <em>think</em> are needed, but need to get confirmation on.</p>
  
  <p><strong>Client-side configuration for Scenario 1</strong>: Use <code>nettyChannelBuilder.usePlaintext(true)</code>. This will disable TLS on the netty channel to grpc.</p>
  
  <p><strong>Client-side configuration for Scenario 2</strong>: Set the sslContext using  <code>nettyChannelBuilder.negotiationType(NegotiationType.TLS).sslContext(GrpcSslContexts.configure(SslContextBuilder.forClient(), SslProvider.OPENSSL).build())</code>. This will configure the channel to communicate through TLS to grpc server using the default ciphers and application protocol configs.</p>
  
  <p><strong>Client-side configuration for Scenario 3</strong>: Set up TLS for the netty channel using  <code>nettyChannelBuilder.negotiationType(NegotiationType.TLS).sslContext(GrpcSslContexts.configure(SslContextBuilder.forClient(), SslProvider.OPENSSL).sslContextBuilder.trustManager(clientAuthCertFile)
  .clientAuth(ClientAuth.OPTIONAL).build())</code> where <code>clientAuthCertFile</code> is the trust cert file and <code>ClientAuth.OPTIONAL</code> can also be <code>ClientAuth.REQUIRED</code> if you require mutual TLS.</p>
  
  <p>Is there anything incorrect with my client-side configurations? Do I need any tweaks? I will add this as a PR to the security.md file after getting some blessing from the community on this post.</p>