fullstorydev / fullstorydev/grpcurl

Dial fails with a timeout when the server requires a client certificate, but none is provided

Open
#482 1 comment 2 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
12.8k
Forks
580
Avg merge
1h 8m
Merged PRs (30d)
5

Description

When the server requires a client certificate, and `grpcurl` is not configured with the `-cert/-key` options, it fails with a timeout instead of an explicit message, even though the server communicates the problem with a `certificate_required` [alert](https://datatracker.ietf.org/doc/html/rfc8446#section-6) and closes the connection.

1. Steps to reproduce: create a server that requires a client certificate (for example by modifying the grpc-go authentication to pass a `tls.Config` with `tls.RequireAndVerifyClientCert`).
2. Run grpcurl -insecure localhost:50051 list

Expected output (this is what grpc-go outputs when letting an RPC fail or dialing `WithBlock`):
```
Failed to dial target host "localhost:50051": desc = "error reading server preface: remote error: tls: certificate required
```

Actual output:
```
Failed to dial target host "localhost:50051": context deadline exceeded
```

grpcurl seems to not consider the alert fatal and continue attempting to dial.

Screenshot 2024-09-09 at 11 07 24

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the issue with a grpc-go server using tls.RequireAndVerifyClientCert, then trace grpcurl's dialing and retry behavior for `-insecure localhost:50051 list`. Done means the `certificate_required` alert is treated as fatal and the command reports the explicit TLS error instead of waiting for a timeout.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.