0.12 reports invalid cert where 0.11 succeeded

[AArnott]

Bug Report

After upgrading tonic from 0.11.0 to 0.12.2, gRPC connections fail with InvalidCertificate(UnknownIssuer) for the exact same server endpoint.

Platform

Windows

Crates

tonic

Description

A very trivial repro, comprising just this:

use tonic::transport::{Channel, ClientTlsConfig, Uri};

#[tokio::main]
async fn main() -> Result<(), tonic::transport::Error> {
    let uri = "https://zec.rocks:443/".parse::<Uri>().unwrap();
    let tls = ClientTlsConfig::new().domain_name(uri.host().unwrap());
    let channel = Channel::builder(uri.clone())
        .tls_config(tls)?
        .connect()
        .await?;

    println!("Hello, world!");
    Ok(())
}

Succeeds when using tonic 0.11, but fails on 0.12.x.

I have the minimal repro ready to cargo run at this repo: https://github.com/aarnott/tonic_fail_repro (main branch works, broken branch doesn't). The only difference between them is the tonic version.

Expected (0.11 behavior)

Hello, world!

Actual (0.12.x behavior)

Error: tonic::transport::Error(Transport, ConnectError(Custom { kind: InvalidData, error: InvalidCertificate(UnknownIssuer) }))
error: process didn't exit successfully: `target\debug\gRpcTest.exe` (exit code: 1)

[AArnott]

In the original project that led to this report, I was getting transport error instead of InvalidCertificate. But in both cases, just upgrading tonic as described above is the only thing that causes it to fail.

[str4d]

I expect this is the same issue I ran into with this upgrade, specifically this entry in the 0.12.0 changelog:

BREAKING CHANGES

• Removed implicit configuration of client TLS roots setup (feat(tls): Remove tls roots implicit configuration #1731)

This was originally undocumented in the 0.12.0 release notes; the line was added later in #1781.

[str4d]

The fix is to use one of these methods:

• ClientTlsConfig::with_native_roots
• ClientTlsConfig::with_webpki_roots
• ClientTlsConfig::with_enabled_roots (newly added in 0.12.2 by fix(tonic-build,tonic) Add back TLS handling in generated Client::connect code #1866, as a side-effect of fixing breakage caused by feat(tls): Remove tls roots implicit configuration #1731)

[AArnott]

Confirmed. Thank you!