🎯 Practical: feat: Add GRPC TLS support by godexsoft · Pull Request #6374 · XRPLF/rippled · GitHub

godexsoft · 2026-02-17T12:10:26Z

High Level Overview of Change

This PR enhances the gRPC server with optional TLS and mTLS support.

Context of Change

Type of Change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Refactor (non-breaking change that only restructures code)
Performance (increase or change in throughput and/or latency)
Tests (you added tests for code that already exists, or your new feature included in this PR)
Documentation update
Chore (no impact to binary, e.g. .gitignore, formatting, dropping support for older tooling)
Release

API Impact

Public API: New feature (new methods and/or new fields)
Public API: Breaking change (in general, breaking changes should only impact the next api_version)
libxrpl change (any change that may affect libxrpl or dependents of libxrpl)
Peer protocol change (must be backward compatible or bump the peer protocol version)

Copilot

Pull request overview

Adds optional TLS configuration to the gRPC server and updates tests/docs to support TLS/mTLS scenarios.

Changes:

Parse ssl_cert/ssl_key/ssl_chain from [port_grpc] and build gRPC server credentials accordingly.
Add envconfig helpers to generate TLS-enabled gRPC configs for tests.
Add a new unit test suite plus example config documentation for gRPC TLS settings.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
`src/xrpld/app/main/GRPCServer.h`	Stores TLS config paths and declares a credentials factory helper.
`src/xrpld/app/main/GRPCServer.cpp`	Reads TLS settings from config and switches gRPC listener credentials to TLS when configured.
`src/test/jtx/impl/envconfig.cpp`	Adds helper functions to populate TLS fields in test configs.
`src/test/jtx/envconfig.h`	Declares the new TLS-related envconfig helpers.
`src/test/app/GRPCServerTLS_test.cpp`	Introduces tests intended to cover TLS and “mTLS” gRPC startup paths.
`cfg/xrpld-example.cfg`	Documents the new `[port_grpc]` TLS settings and provides example values.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (1)

src/xrpld/app/main/GRPCServer.cpp:10

#include <boost/filesystem.hpp> appears to be unused in this file (no boost::filesystem symbols are referenced). Consider removing it to reduce compile time and avoid unnecessary dependencies (FileUtilities.h already brings in the needed Boost types).

namespace xrpl {

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

codecov · 2026-02-17T14:15:23Z

Codecov Report

❌ Patch coverage is 94.18605% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.8%. Comparing base (653a383) to head (58ee580).
⚠️ Report is 5 commits behind head on develop.

Files with missing lines	Patch %	Lines
src/xrpld/app/main/GRPCServer.cpp	94.2%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##           develop   #6374     +/-   ##
=========================================
+ Coverage     81.6%   81.8%   +0.2%     
=========================================
  Files         1010    1010             
  Lines        75992   76075     +83     
  Branches      7601    7529     -72     
=========================================
+ Hits         62013   62216    +203     
+ Misses       13979   13859    -120

Files with missing lines	Coverage Δ
src/xrpld/app/main/GRPCServer.h	`100.0% <ø> (ø)`
src/xrpld/app/main/GRPCServer.cpp	`81.5% <94.2%> (+38.6%)`	⬆️

... and 6 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

mathbunnyru · 2026-04-09T17:36:59Z

+
+namespace {
+
+constexpr std::string_view kCA_CERT_CONTENT =


I would appreciate it if you added commands in comments how you generated these certs, so it can be done again, if ever needed

It's in fact done by asking AI to regenerate them, like most things these days 🤖
But also it should not be needed again - the last thing i did is regenerated it with as far possible expiry as possible so it ended up being a full 100 years from now.

mathbunnyru · 2026-04-09T17:42:24Z

+    if (sslCertPath_.has_value() && sslKeyPath_.has_value())
+    {


I would probably do a fast return in case it's without certificate.
This would decrease the identation (now almost the whole function is under if)

mathbunnyru · 2026-04-09T17:44:05Z

+        JLOG(journal_.error())
+            << "Failed to start gRPC server at " << serverAddress_ << " (TLS mode: " << tlsMode
+            << "); Possible causes: address already in use, invalid address format, or permission "
+               "denied";  // LCOV_EXCL_LINE


Do we need all these LCOV_EXCL_LINEs?

It's common.. JLOG lines produce coverage issues apparently. But tbf i'm not too sure this particular one does anything because it's not on the same line technically. I'd leave it though as that's the general pattern used

mathbunnyru

A few nits, nothing major, approving, but would be glad if these nits were fixed

bthomee · 2026-04-17T14:18:19Z

+        grpc::SslServerCredentialsOptions sslOpts;
+        sslOpts.pem_key_cert_pairs.push_back(keyCertPair);
+
+        // Configure client certificate verification (mTLS) if CA is provided
+        if (sslClientCAPath_.has_value())
+        {
+            if (clientCAContents.empty())
+            {
+                JLOG(journal_.error())
+                    << "Empty/truncated gRPC SSL client CA file: " << *sslClientCAPath_
+                    << " - failed to configure mutual TLS";  // LCOV_EXCL_LINE
+                return nullptr;
+            }
+
+            sslOpts.pem_root_certs = clientCAContents;
+            sslOpts.client_certificate_request =
+                GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY;
+            JLOG(journal_.info()) << "gRPC mutual TLS enabled - client certificates will be "
+                                     "required and verified";
+        }


This can be moved above. If the sslOpts are defined earlier, then around line 616 you already confirmed that sslClientCAPath_.has_value(), so you can perform the clientCAContents.empty() check there right away, and fill the sslOpts with the values.

github-actions · 2026-04-17T17:08:11Z

This PR has conflicts, please resolve them in order for the PR to be reviewed.

github-actions · 2026-04-20T14:48:42Z

All conflicts have been resolved. Assigned reviewers can now start or resume their review.

…feature/grpc-tls

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

godexsoft added 6 commits February 16, 2026 14:54

Add support for server certs for grpc

6912a21

Add tests for xrpld and grpc specifically

5bfbca8

Remove gtest and add beast tests for grpc startup with certs

403249c

Add mTLS test

0fd8f0e

Add documentation about gRPC TLS config

02d8fa1

Fix clang-format

7822b97

Copilot AI review requested due to automatic review settings February 17, 2026 12:10

Copilot started reviewing on behalf of godexsoft February 17, 2026 12:11 View session

Copilot AI reviewed Feb 17, 2026

View reviewed changes

godexsoft added 2 commits February 17, 2026 12:19

Fix cspell

37ee715

Fix copilot review comments

cc2bc4d

Copilot AI review requested due to automatic review settings February 17, 2026 13:56

Copilot started reviewing on behalf of godexsoft February 17, 2026 13:56 View session

Fix copilot review comments 2

5c94bc5

Copilot AI reviewed Feb 17, 2026

View reviewed changes

Comment thread cfg/xrpld-example.cfg Outdated

Comment thread src/xrpld/app/main/GRPCServer.cpp Outdated

Comment thread src/xrpld/app/main/GRPCServer.cpp Outdated

Comment thread src/xrpld/app/main/GRPCServer.cpp

Comment thread src/test/app/GRPCServerTLS_test.cpp

godexsoft and others added 2 commits February 17, 2026 18:42

Add tests with actual connections

db398c2

Update cfg/xrpld-example.cfg

b3b61f9

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings February 18, 2026 13:21

Copilot started reviewing on behalf of godexsoft February 18, 2026 13:21 View session

Copilot AI reviewed Feb 18, 2026

View reviewed changes

Comment thread src/test/app/GRPCServerTLS_test.cpp

Comment thread src/test/app/GRPCServerTLS_test.cpp

godexsoft added 4 commits February 18, 2026 13:33

Fix some more copilot review issues

5ff57b9

Add test for invalid config with chain

164eaa0

Merge branch 'develop' into feature/grpc-tls

da36d3d

Add some exclusions for coverage

5a40d68

Copilot AI review requested due to automatic review settings February 18, 2026 17:21

Copilot started reviewing on behalf of godexsoft February 18, 2026 17:22 View session

Copilot AI reviewed Feb 18, 2026

View reviewed changes

Add more tests and fix the way we treat mTLS and cert chain

e98fd4e

godexsoft added 2 commits April 9, 2026 14:29

Fix review comments

b09b103

Fix clang-tidy

d8ad532

mathbunnyru reviewed Apr 9, 2026

View reviewed changes

mathbunnyru approved these changes Apr 9, 2026

View reviewed changes

godexsoft added 2 commits April 9, 2026 19:07

Fix review suggestion

c3dbca1

Even better

c14d6b7

bthomee added the Ready to merge *PR author* thinks it's ready to merge. Has passed code review. Perf sign-off may still be required. label Apr 10, 2026

bthomee reviewed Apr 17, 2026

View reviewed changes

godexsoft added 3 commits April 17, 2026 15:43

Merge branch 'develop' into feature/grpc-tls

2120350

Apply review suggestion

9bdf213

Fix clang-tidy

5b771eb

github-actions Bot added the PR: has conflicts label Apr 17, 2026

Merge and fix conflicts

78d7958

github-actions Bot removed the PR: has conflicts label Apr 20, 2026

godexsoft added 4 commits April 20, 2026 16:25

More fixes

de64996

Merge branch 'feature/grpc-tls' of github.com:godexsoft/rippled into …

0c69ff5

…feature/grpc-tls

Fix format

6ad8df6

Fix clang-tidy

58ee580

bthomee changed the title ~~feat: GRPC TLS support~~ feat: Add GRPC TLS support Apr 20, 2026

bthomee enabled auto-merge April 20, 2026 17:11

bthomee added this pull request to the merge queue Apr 20, 2026

Merged via the queue into XRPLF:develop with commit 726f20c Apr 20, 2026
3 checks passed

marek-foss-neti pushed a commit to marek-foss-neti/rippled that referenced this pull request May 5, 2026

feat: Add GRPC TLS support (XRPLF#6374)

5cf9e0c

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

beartec-jpg pushed a commit to beartec-jpg/FalconLedger that referenced this pull request Jun 1, 2026

feat: Add GRPC TLS support (XRPLF#6374)

1402a4e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

rachelflynn mentioned this pull request Jun 5, 2026

Add tls support to grpc (rippled #6374) XRPLF/xrpl-dev-portal#3679

Merged

Uh oh!

Conversation

godexsoft commented Feb 17, 2026

High Level Overview of Change

Context of Change

Type of Change

API Impact

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mathbunnyru Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

godexsoft Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

mathbunnyru Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

mathbunnyru Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

godexsoft Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

mathbunnyru left a comment

Choose a reason for hiding this comment

Uh oh!

bthomee Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 17, 2026

Uh oh!

github-actions Bot commented Apr 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

codecov Bot commented Feb 17, 2026 •

edited

Loading

mathbunnyru Apr 9, 2026 •

edited

Loading