x509: certificate signed by unknown authority about grpcurl HOT 9 CLOSED

@jhump Thanks for reply. I tried -insecure flags, but still got same error.

☁  grpc-go-cnode [master] grpcurl localhost:3000 list -insecure                  
Failed to dial target host "localhost:3000": x509: certificate signed by unknown authority

server logs:

2020/08/28 12:38:50 http: TLS handshake error from [::1]:57784: remote error: tls: bad certificate

So, I want to try -cacert flag. How should I use this flag? Which certificate should be used?

UPDATE:

-insecure flag works fine. Pay attention to the order of the parts of the command

 grpcurl [flags] [address] [list|describe] [symbol]

☁  grpc-go-cnode [master] grpcurl -insecure localhost:3000 list 
grpc.health.v1.Health
grpc.reflection.v1alpha.ServerReflection
topic.TopicService
user.UserService

-cacert flag works fine too. Example:

☁  grpc-go-cnode [master] grpcurl -cacert=./assets/server.crt localhost:3000 list 
grpc.health.v1.Health
grpc.reflection.v1alpha.ServerReflection
topic.TopicService
user.UserService

from grpcurl.

@gugahoi, correct. If you want to verify the self-signed cert (vs. just trusting any server cert), you would add it to your set of trusted root certs with the -cacert option.

from grpcurl.

-insecure

from grpcurl.

This is actually ignoring the handshake instead of accepting certificates. I assume the cacert option the the correct way about this but unsure?

from grpcurl.

same issue for self-signed certificates generated by below shell script:

#!/bin/sh

echo "generating credentials and private key for server and client..."
openssl genrsa -out ./assets/server.key 2048

openssl req -new -x509 -days 3650 \
  -subj "/C=GB/L=China/O=grpo-server/CN=localhost" \
  -key ./assets/server.key -out ./assets/server.crt

openssl genrsa -out ./assets/client.key 2048

openssl req -new -x509 -days 3650 \
  -subj "/C=GB/L=China/O=grpo-client/CN=localhost" \
  -key ./assets/client.key -out ./assets/client.crt

from grpcurl.

@mrdulin, did you read the above comments and why the issue is closed? This is expected behavior. You have to configure grpcurl to either not check the cert (-insecure) or to trust it (-cacert).

from grpcurl.

I am also facing same issue -insecure works fine but I wanted to verify the self-signed cert can anyone give the good example how to use the -cacert flag and from where should I get the certificate

from grpcurl.

hi, Can anyone tell me how to use -cacert and which certificate to submit its been 2 months since I have stuck with it

from grpcurl.

i grpcurl -cacert=ca.pem -d='{"id":""}' user-service:443 GetUser
still getting
x509: certificate signed by unknown authority
any help?

from grpcurl.