<p>I've developed a gRPC service that is deployed on a Kubernetes cluster, and I'm using grpc-web from nodejs clients to connect to it. This means I need a proxy in front of the service. Everything works perfectly with <a href="https://gist.github.com/diericx/9001115a3ecf084493b520b6c17655d7" rel="nofollow noreferrer">this envoy configuration</a> without SSL, but now I need to secure the connections to get it ready for production.  </p>

<p><strong>Here are the steps I've gone through</strong>  </p>

<p>1) Generated the keys, entering my domain <code>simulation.terrarium.ai</code> when asked using <a href="https://gist.github.com/fntlnz/cf14feb5a46b2eda428e000157447309" rel="nofollow noreferrer">this tutorial</a></p>

<p>2) Edit the Dockerfile to add the keys</p>

<pre><code>FROM envoyproxy/envoy:latest

COPY envoy-proxy-tls.yaml /etc/envoy.yaml

EXPOSE 9091

ADD ./certs/simulation.terrarium.ai.crt /etc/simulation.terrarium.ai.crt
ADD ./certs/simulation.terrarium.ai.key /etc/simulation.terrarium.ai.key
ADD ./certs/rootCA.crt /etc/rootCA.crt

WORKDIR /etc/envoy
CMD /usr/local/bin/envoy -c /etc/envoy.yaml
</code></pre>

<p>3) Updated the envoy config to use tls on the port</p>

<p><a href="https://gist.github.com/diericx/cc0398c0a3bb143523960221f9a3058f" rel="nofollow noreferrer">It's much easier to read this config file with highlighting so here is a gist of it.</a></p>

<p><strong>What's Happening</strong><br>
I make calls to my service like this</p>

<pre><code>var simService = new SimulationServiceClient(ServerAddress, null, null);

var request = new CreateSpectatorRequest();
request.setApi(API_VERSION);
request.setId(this.clientId);
var metadata = {};
var stream = simService.createSpectator(request, metadata);
stream.on("data", this.onData);
stream.on("status", this.onStatus);
stream.on("end", this.onEnd);
</code></pre>

<p>At this point I have my grpc service and the envoy proxy running in a kubernetes cluster, the same way I did before adding TLS. When I try to connect from my browser I get this error:</p>

<pre><code>https://simulation.terrarium.ai:9091/v1.SimulationService/SubscribeSpectatorToRegion net::ERR_CERT_AUTHORITY_INVALID
</code></pre>

<p>I'm having a really hard time debugging this as I'm not sure exactly where the error could be occurring. Any help would be appreciated!</p>

<p>I'm using GKE and just found this link that shows <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs" rel="nofollow noreferrer">how to use a Google Managed SSL Certificate</a>.  </p>

<p>It works perfectly for me! Sorry I couldn't solve this issue exactly but this is a way easier alternative as they also handle automation for the certificates.</p>
