gRPC secure server accepts insecure client connections - c++

Question

I have a simple gRPC server / client implementation where I have setup the server to use grpc::SslServerCredentials
Then I have a client that uses the credentials channel grpc::SslCredentials to connect to it successfully.
But to my astonishment I can also connect using grpc::InsecureChannelCredentials to the secure server.
I have probably misunderstood something so it is most likely that I have forgot to call some method in the gRPC API or something that is just conceptually wrong in my code.
What have I missed? I mean why can my insecure channel connect to the secure server?
Is there some kind of exception to the rule since I use "localhost"?
Code sample for server:
void start_server() {
MyServiceServer service;
grpc::EnableDefaultHealthCheckService(true);
grpc::reflection::InitProtoReflctionServerBuilderPlugin();
ServerBuilder builder;
grpc::SslServerCredentialsOptions::PemKeyCertPair keycert;
keycert.private_key = load_as_text("server.key");
keycert.cert_chain = load_as_text("server.crt");
grpc::SslServerCredentialsOptions ssl_opts;
ssl_opts.pem_root_certs = load_as_text("ca.crt");
ssl_opts.pem_key_cert_pairs.push_back(keycert);
std::shared_ptr<grpc::ServerCredentials> channel_creds = grpc::SslServerCredentials(ssl_opts);
builder.AddListeningPort("localhost:50051", channel_creds);
builder.RegisterService(&service);
std::unique_ptr<Server> server(builder.BuildAndStart());
// Wait for the server to shutdown.
server->Wait();
std::cout << "Server shutting down\n";
}
Code sample for client:
void start_client(const std::string& server_address, int num_requests, int packet_size) {
#if 0
std::cout << "Insecure channel\n";
std::shared_ptr<grpc::ChannelCredentials> channel_creds = grpc::InsecureChannelCredentials();
#else
std::cout << "Secure channel\n";
grpc::SslCredentialsOptions ssl_opts = {
load_as_text("ca.crt"),
load_as_text("client.key"),
load_as_text("client.crt")
};
std::shared_ptr<grpc::ChannelCredentials> channel_creds = grpc::SslCredentials ( ssl_opts );
#endif
std::shared_ptr<Channel> channel = grpc::CreateChannel("127.0.0.1:50051", channel_creds);
MyServiceClient client(channel);
Status s = client.HelloThere();
std::cout << MyToString(s) << "\n";
}
I have tried it now several times and it works for both cases.
Anyone can hint what's wrong?
EDIT 2022-01-21:
I am not allowed to share the full source code from my workplace but I can verify that the returned status in the client from the call in both secure/insecure connection is Status::OK.
I've updated the example above with my conceptual printing of the status code.
I want to emphasize that it is probably I who have done something wrong so I will share the code that I use as proof of concept to generate the keys here:
#!/bin/bash
echo
echo "Generate CA"
openssl genrsa -passout pass:1234 -des3 -out ca.key 4096
openssl req -passin pass:1234 -new -x509 -days 365 -key ca.key -out ca.crt -subj "/C=CA/ST=Ontario/L=Ontario/O=Test/OU=Test/CN=Root CA"
echo
echo
echo "Generate Server Key/Cert"
openssl genrsa -passout pass:1234 -des3 -out server.key 4096
openssl req -passin pass:1234 -new -key server.key -out server.csr -subj "/C=CA/ST=Ontario/L=Ontario/O=Test/OU=Server/CN=localhost"
openssl x509 -req -passin pass:1234 -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt
echo
echo
echo "Remove passphrase from the Server Key"
openssl rsa -passin pass:1234 -in server.key -out server.key
echo
echo
echo "Generate Client Key/Cert"
openssl genrsa -passout pass:1234 -des3 -out client.key 4096
openssl req -passin pass:1234 -new -key client.key -out client.csr -subj "/C=CA/ST=Ontario/L=Ontario/O=Test/OU=Client/CN=localhost"
openssl x509 -passin pass:1234 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt
echo
echo
echo "Remove passphrase from Client Key"
openssl rsa -passin pass:1234 -in client.key -out client.key
Maybe it is related to how I generate the certificates?
The server and client programs run on the same machine.