Unable to Establish Insecure gRPC connection on the New AWS gRPC ELB

Question

AWS ALB has the new support for gRPC load balancing as per this Link

All the explanation indicates using an ssl connection between the client & the server. Now, this might be required if client is browser, but in the case of Internal ALB & Intra service communication, I would not like to have secure connection.

Is this possible/ Has anyone got more info on how to load balance without ssl?

What I understand: Pick your domain name, generate a certificate. Add Alias for this in Route 53 (same domain name) & use the certificates in client & server for intra-servie communication in Internal ELB.

Is this the only way possible? I have to also manage this certificate.

Answer 1

After trying a lot of things, These are my conclusions.

1. You cannot make insecure gRPC requests to AWS ALB.
2. You can make insecure gRPC requests from AWS ALB to Target Groups.

The steps required:

Server Side: No SSL required. You can start Server on insecure channel.

Client Side: Ssl is required. new ClientClass(<Route 53 endpoint which maps to AWS ALB Endpoint>, credentials.createSsl());

Make sure, Certificates on AWS ALB matches the Route 53 alias endpoint of aws alb.

Conclusion: Client make requests to ALB, via the certificate issued by ALB to client. ALB makes insecure requests to TG (forwarding to server listening on insecure channel ) You can also make ALB to TG requests as secure, this would server side SSL changes