how and where to add TLS to a tonic GRPC server?

[tdelabro]

I'm building a gRPC server using tonic.

I would like to have it use HTTPS. I think I can do this using https://docs.rs/tonic/latest/tonic/transport/struct.Server.html#method.tls_config, but people I talked with also told me that I can just not do that, and enforce HTTPS at the infra provider level (AWS, google cloud).

I would be curious to have advice, feedback, and an explanation on this matter

[ivyhjk]

You need to generate or purchase a digital certificate first; you can't use one provided by AWS Certificate Manager.

Then, on your Tonic server:

rustls::crypto::aws_lc_rs::default_provider()
        .install_default()
        .expect("Crypto provider installation failed");

let certificate = tokio::fs::read("fullchain.pem").await?;
let private_key = tokio::fs::read("privkey.pem").await?;
let identity = tonic::transport::Identity::from_pem(certificate, private_key);

let tls_config = tonic::transport::ServerTlsConfig::new().identity(identity);

tonic::transport::Server::builder()
        .tls_config(tls_config)
        add_service(your_service)