Unable to Establish Insecure gRPC connection on the New AWS gRPC ELB

Question

AWS ALB has the new support for gRPC load balancing as per this Link

All the explanation indicates using an ssl connection between the client & the server. Now, this might be required if client is browser, but in the case of Internal ALB & Intra service communication, I would not like to have secure connection.

Is this possible/ Has anyone got more info on how to load balance without ssl?

What I understand: Pick your domain name, generate a certificate. Add Alias for this in Route 53 (same domain name) & use the certificates in client & server for intra-servie communication in Internal ELB.

Is this the only way possible? I have to also manage this certificate.

Answer 1

Bump! What configuration require for ALB supports TLS termination for GRPC requests? I'd prefer to avoid the encryption overhead behind the firewall/ALB.

Bloom RPC produces this exception:

{ "error": "14 UNAVAILABLE: failed to connect to all addresses" }

GRPC is failing with this exception:

2020-12-29 03:03:33.345 INFO 3719 --- [-worker-ELG-6-1] i.g.n.NettyServerTransport.connections : Transport failed Dec 29 03:03:33 ip-172-31-22-196 web: io.netty.handler.codec.http2.Http2Exception: HTTP/2 client preface string missing or corrupt. Hex dump for received bytes: 16030100ac010000a80303496e418aff3efff4c9244b9ae2

Connection Error io.netty.handler.codec.http2.Http2Exception: HTTP/2 client preface string missing or corrupt. Hex dump for received bytes:

Answer 2

After trying a lot of things, These are my conclusions.

1. You cannot make insecure gRPC requests to AWS ALB.
2. You can make insecure gRPC requests from AWS ALB to Target Groups.

The steps required:

Server Side: No SSL required. You can start Server on insecure channel.

Client Side: Ssl is required. new ClientClass(<Route 53 endpoint which maps to AWS ALB Endpoint>, credentials.createSsl());

Make sure, Certificates on AWS ALB matches the Route 53 alias endpoint of aws alb.

Conclusion: Client make requests to ALB, via the certificate issued by ALB to client. ALB makes insecure requests to TG (forwarding to server listening on insecure channel ) You can also make ALB to TG requests as secure, this would server side SSL changes