fullstorydev / fullstorydev/grpcurl
Dial fails with a timeout when the server requires a client certificate, but none is provided
- Dominant language
- Go
- Stars
- 12.8k
- Forks
- 580
- Avg merge
- 1h 8m
- Merged PRs (30d)
- 5
Description
When the server requires a client certificate, and `grpcurl` is not configured with the `-cert/-key` options, it fails with a timeout instead of an explicit message, even though the server communicates the problem with a `certificate_required` [alert](https://datatracker.ietf.org/doc/html/rfc8446#section-6) and closes the connection.
1. Steps to reproduce: create a server that requires a client certificate (for example by modifying the grpc-go authentication to pass a `tls.Config` with `tls.RequireAndVerifyClientCert`).
2. Run grpcurl -insecure localhost:50051 list
Expected output (this is what grpc-go outputs when letting an RPC fail or dialing `WithBlock`):
```
Failed to dial target host "localhost:50051": desc = "error reading server preface: remote error: tls: certificate required
```
Actual output:
```
Failed to dial target host "localhost:50051": context deadline exceeded
```
grpcurl seems to not consider the alert fatal and continue attempting to dial.
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the issue with a grpc-go server using tls.RequireAndVerifyClientCert, then trace grpcurl's dialing and retry behavior for `-insecure localhost:50051 list`. Done means the `certificate_required` alert is treated as fatal and the command reports the explicit TLS error instead of waiting for a timeout.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, networking
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100