I am starting with gRPC and one of the things in which I have problems is with the security in the communication.
I am using a self signed certificates, so I have created my CA and the certificates for the server and the clients.
Until now, I thought it was needed to have certificate in the client side, but according to this question, How to open a secure channel in python gRPC client without a client SSL certificate, it is seems that it is not needed to have certificates in the client application to still have a secure channel in which the communication is encrypted.
My case is this. I would like to develop a mobile application with MAUI to connect to a gRPC server and I would like to authenticate in a secure way and encrypt all the traffic.
For me the worse part is how to handle the certificates in the client application, beacuse I would like to avoid to have to install a unique certificate for each client, beacuse for the users it would be hard to install it. In this way, I was thinking how applications like Whatsapp works, beacuse I don't need to install any certificate and the communitacion is encrypted extrem to extrem.
Perhaps I could have a unique client certificate at the application level, but in this case I should to include the key in the application installer, but in this way I am making public the private key, so I guess it is not a secure option.
Then I have seen in the above post that it is not needed to have certificates in the client side to still have an encrypted channel, so it is when I have doubts.
Really is it possible to have a secure channel without needed to have certificates in the client side, only in the server side?
If it is possible, when it is interesting to use certificates in the client side?
If it is possible, how could I implement the channel in the client side without certificates?
Thanks.
When you create a secure gRPC channel (with trust roots a.k.a roots.pem), you'll get encrypted connection even without providing client certificates. The client certificates are used with TLS when you want to check the client's identity as well (on top of already checking the server's identity). Anytime you use TLS, at least the server's identity needs to be checked (which is what the trust roots are for), since there's no point of reaching out to a server and using encrypted connections unless you're sure you're talking to the right server. Once you've established and encrypted connections to the server, you can use various methods for authenticating the client (using client-side certs is only one of the options).
Feels free to check e.g. the talk here: https://github.com/jtattermusch/grpc-authentication-kubernetes-examples