How to Implement End-to-End Encryption for gRPC 1.60 Services With OpenSSL 3.2: Step-by-Step Fintech Guide

#!/bin/bash
# generate_certs.sh: Generate mTLS certificates for gRPC 1.60 E2EE using OpenSSL 3.2
# Requires: OpenSSL 3.2.0+, gRPC 1.60+, protobuf 25.3+
set -euo pipefail

# Configuration
OPENSSL_BIN="openssl"
REQUIRED_OPENSSL_VERSION="3.2"
ROOT_CA_DIR="./certs/root-ca"
SERVER_CERT_DIR="./certs/server"
CLIENT_CERT_DIR="./certs/client"
CERT_VALIDITY_DAYS=7
KEY_SIZE=4096
CURVE="secp384r1" # P-384 for FIPS 140-3 compliance

# Error handling function
error() {
    echo "ERROR: $1" >&2
    exit 1
}

# Check OpenSSL version
check_openssl_version() {
    local openssl_version
    openssl_version=$($OPENSSL_BIN version | awk '{print $2}')
    if [[ ! "$openssl_version" =~ ^$REQUIRED_OPENSSL_VERSION\. ]]; then
        error "OpenSSL version $REQUIRED_OPENSSL_VERSION is required, found $openssl_version"
    fi
    echo "Using OpenSSL version: $openssl_version"
}

# Create certificate directories
create_dirs() {
    mkdir -p "$ROOT_CA_DIR" "$SERVER_CERT_DIR" "$CLIENT_CERT_DIR"
    echo "Created certificate directories"
}

# Generate root CA
generate_root_ca() {
    echo "Generating root CA..."
    # Generate root CA private key (password protected for production, removed for demo)
    $OPENSSL_BIN ecparam -name "$CURVE" -genkey -noout -out "$ROOT_CA_DIR/ca.key"
    # Generate root CA certificate
    $OPENSSL_BIN req -new -x509 -key "$ROOT_CA_DIR/ca.key" -out "$ROOT_CA_DIR/ca.crt" \
        -days $((CERT_VALIDITY_DAYS * 52)) \
        -subj "/C=US/ST=NY/L=New York/O=FintechGRPC/CN=Root CA" \
        -addext "basicConstraints=critical,CA:TRUE,pathlen:0" \
        -addext "keyUsage=critical,keyCertSign,cRLSign"
    echo "Root CA generated: $ROOT_CA_DIR/ca.crt"
}

# Generate server certificate
generate_server_cert() {
    echo "Generating server certificate..."
    # Generate server private key
    $OPENSSL_BIN ecparam -name "$CURVE" -genkey -noout -out "$SERVER_CERT_DIR/server.key"
    # Generate certificate signing request (CSR)
    $OPENSSL_BIN req -new -key "$SERVER_CERT_DIR/server.key" -out "$SERVER_CERT_DIR/server.csr" \
        -subj "/C=US/ST=NY/L=New York/O=FintechGRPC/CN=payment-processor.fintech.local" \
        -addext "subjectAltName=DNS:payment-processor.fintech.local,DNS:localhost,IP:127.0.0.1"
    # Sign CSR with root CA
    $OPENSSL_BIN x509 -req -in "$SERVER_CERT_DIR/server.csr" \
        -CA "$ROOT_CA_DIR/ca.crt" -CAkey "$ROOT_CA_DIR/ca.key" -CAcreateserial \
        -out "$SERVER_CERT_DIR/server.crt" -days "$CERT_VALIDITY_DAYS" \
        -addext "keyUsage=critical,digitalSignature,keyEncipherment" \
        -addext "extendedKeyUsage=critical,serverAuth"
    echo "Server certificate generated: $SERVER_CERT_DIR/server.crt"
}

# Generate client certificate
generate_client_cert() {
    echo "Generating client certificate..."
    # Generate client private key
    $OPENSSL_BIN ecparam -name "$CURVE" -genkey -noout -out "$CLIENT_CERT_DIR/client.key"
    # Generate CSR
    $OPENSSL_BIN req -new -key "$CLIENT_CERT_DIR/client.key" -out "$CLIENT_CERT_DIR/client.csr" \
        -subj "/C=US/ST=NY/L=New York/O=FintechGRPC/CN=payment-client.fintech.local" \
        -addext "subjectAltName=DNS:payment-client.fintech.local"
    # Sign CSR with root CA
    $OPENSSL_BIN x509 -req -in "$CLIENT_CERT_DIR/client.csr" \
        -CA "$ROOT_CA_DIR/ca.crt" -CAkey "$ROOT_CA_DIR/ca.key" -CAcreateserial \
        -out "$CLIENT_CERT_DIR/client.crt" -days "$CERT_VALIDITY_DAYS" \
        -addext "keyUsage=critical,digitalSignature,keyEncipherment" \
        -addext "extendedKeyUsage=critical,clientAuth"
    echo "Client certificate generated: $CLIENT_CERT_DIR/client.crt"
}

# Main execution
main() {
    check_openssl_version
    create_dirs
    generate_root_ca
    generate_server_cert
    generate_client_cert
    echo "All certificates generated successfully. Verify with: $OPENSSL_BIN verify -CAfile $ROOT_CA_DIR/ca.crt $SERVER_CERT_DIR/server.crt"
}

main

// server.cpp: gRPC 1.60 PaymentProcessor server with OpenSSL 3.2 mTLS
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include "payment.pb.h"
#include "payment.grpc.pb.h"
#include 
#include 
#include 
#include 
#include 

using grpc::Server;
using grpc::ServerBuilder;
using grpc::ServerContext;
using grpc::Status;
using payment::PaymentRequest;
using payment::PaymentResponse;
using payment::PaymentProcessor;

// Implementation of the PaymentProcessor service
class PaymentProcessorServiceImpl final : public PaymentProcessor::Service {
    Status ProcessPayment(ServerContext* context, const PaymentRequest* request,
                          PaymentResponse* response) override {
        // Validate request fields
        if (request->amount() <= 0) {
            return Status(grpc::INVALID_ARGUMENT, "Payment amount must be positive");
        }
        if (request->currency().empty()) {
            return Status(grpc::INVALID_ARGUMENT, "Currency is required");
        }
        // Simulate payment processing (fintech production logic would integrate with payment gateway)
        std::cout << "Processing payment: " << request->amount() << " " << request->currency()
                  << " for user " << request->user_id() << std::endl;
        response->set_transaction_id("txn_" + std::to_string(rand() % 1000000));
        response->set_status("APPROVED");
        response->set_timestamp(time(nullptr));
        return Status::OK;
    }
};

// Helper function to read file contents (error handling included)
std::string read_file(const std::string& path) {
    std::ifstream file(path, std::ios::in | std::ios::binary);
    if (!file.is_open()) {
        throw std::runtime_error("Failed to open file: " + path);
    }
    std::string content((std::istreambuf_iterator(file)), std::istreambuf_iterator());
    file.close();
    return content;
}

// Initialize OpenSSL 3.2 SSL context for mTLS
std::shared_ptr init_server_credentials() {
    // Load server certificate and key
    grpc::SslServerCredentialsOptions::PemKeyCertPair key_cert_pair;
    key_cert_pair.private_key = read_file("./certs/server/server.key");
    key_cert_pair.cert_chain = read_file("./certs/server/server.crt");

    grpc::SslServerCredentialsOptions ssl_opts;
    ssl_opts.pem_root_certs = read_file("./certs/root-ca/ca.crt");
    ssl_opts.pem_key_cert_pairs.push_back(key_cert_pair);
    // Enable mTLS: require client certificate verification
    ssl_opts.client_certificate_request = GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY;
    // Set cipher suites to OpenSSL 3.2 FIPS-validated AEAD
    ssl_opts.cipher_suites = "TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256";
    // Enable TLS 1.3 only (required for PCI-DSS 4.0)
    ssl_opts.min_tls_version = grpc::TlsVersion::TLS1_3;
    ssl_opts.max_tls_version = grpc::TlsVersion::TLS1_3;

    // Validate OpenSSL 3.2 FIPS mode
    if (FIPS_mode() != 1) {
        std::cerr << "WARNING: OpenSSL FIPS mode not enabled. Enable with OPENSSL_FIPS=1" << std::endl;
    }

    return grpc::SslServerCredentials(ssl_opts);
}

int main(int argc, char** argv) {
    // Initialize OpenSSL 3.2
    OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, nullptr);
    ERR_clear_error();

    // Validate FIPS mode at startup
    if (FIPS_mode() != 1) {
        std::cerr << "FATAL: OpenSSL FIPS mode not enabled" << std::endl;
        return 1;
    }

    std::string server_address("0.0.0.0:50051");
    PaymentProcessorServiceImpl service;

    ServerBuilder builder;
    // Add listening port with mTLS credentials
    builder.AddListeningPort(server_address, init_server_credentials());
    // Register the payment service
    builder.RegisterService(&service);

    // Build and start server
    std::unique_ptr server(builder.BuildAndStart());
    std::cout << "PaymentProcessor server listening on " << server_address << std::endl;

    // Wait for shutdown
    server->Wait();
    return 0;
}

// client.cpp: gRPC 1.60 PaymentProcessor client with OpenSSL 3.2 mTLS
#include 
#include 
#include 
#include 
#include 
#include "payment.pb.h"
#include "payment.grpc.pb.h"
#include 
#include 

using grpc::Channel;
using grpc::ClientContext;
using grpc::Status;
using payment::PaymentRequest;
using payment::PaymentResponse;
using payment::PaymentProcessor;

class PaymentClient {
public:
    PaymentClient(std::shared_ptr channel) : stub_(PaymentProcessor::NewStub(channel)) {}

    // Process a payment via gRPC
    bool ProcessPayment(const std::string& user_id, double amount, const std::string& currency) {
        // Create request
        PaymentRequest request;
        request.set_user_id(user_id);
        request.set_amount(amount);
        request.set_currency(currency);

        // Set metadata (fintech audit trail)
        ClientContext context;
        context.AddMetadata("x-fintech-audit-id", "audit_" + std::to_string(rand() % 1000000));
        context.AddMetadata("x-fintech-service", "payment-client");

        // Send request and get response
        PaymentResponse response;
        Status status = stub_->ProcessPayment(&context, request, &response);

        // Handle response
        if (status.ok()) {
            std::cout << "Payment processed successfully:" << std::endl;
            std::cout << "Transaction ID: " << response.transaction_id() << std::endl;
            std::cout << "Status: " << response.status() << std::endl;
            std::cout << "Timestamp: " << response.timestamp() << std::endl;
            return true;
        } else {
            std::cerr << "Payment failed: " << status.error_message() << std::endl;
            std::cerr << "Error code: " << status.error_code() << std::endl;
            // Log gRPC error details for troubleshooting
            auto error_details = context.GetServerTrailingMetadata();
            if (error_details.find("x-fintech-error") != error_details.end()) {
                std::cerr << "Server error details: " << error_details.at("x-fintech-error").data() << std::endl;
            }
            return false;
        }
    }

private:
    std::unique_ptr stub_;
};

// Helper function to read file contents (same as server)
std::string read_file(const std::string& path) {
    std::ifstream file(path, std::ios::in | std::ios::binary);
    if (!file.is_open()) {
        throw std::runtime_error("Failed to open file: " + path);
    }
    std::string content((std::istreambuf_iterator(file)), std::istreambuf_iterator());
    file.close();
    return content;
}

// Initialize OpenSSL 3.2 client credentials for mTLS
std::shared_ptr init_client_credentials() {
    grpc::SslCredentialsOptions ssl_opts;
    // Load client certificate and key
    ssl_opts.pem_cert_chain = read_file("./certs/client/client.crt");
    ssl_opts.pem_private_key = read_file("./certs/client/client.key");
    // Load root CA for server verification
    ssl_opts.pem_root_certs = read_file("./certs/root-ca/ca.crt");
    // Set cipher suites to match server
    ssl_opts.cipher_suites = "TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256";
    // Enable TLS 1.3 only
    ssl_opts.min_tls_version = grpc::TlsVersion::TLS1_3;
    ssl_opts.max_tls_version = grpc::TlsVersion::TLS1_3;

    return grpc::SslCredentials(ssl_opts);
}

int main(int argc, char** argv) {
    // Initialize OpenSSL 3.2
    OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, nullptr);
    ERR_clear_error();

    // Validate command line arguments
    if (argc != 4) {
        std::cerr << "Usage: " << argv[0] << "   " << std::endl;
        return 1;
    }
    std::string user_id(argv[1]);
    double amount = std::stod(argv[2]);
    std::string currency(argv[3]);

    // Create gRPC channel with mTLS credentials
    std::string server_address("localhost:50051");
    auto credentials = init_client_credentials();
    auto channel = grpc::CreateChannel(server_address, credentials);

    // Create client and process payment
    PaymentClient client(channel);
    bool success = client.ProcessPayment(user_id, amount, currency);

    return success ? 0 : 1;
}

// Validate OpenSSL 3.2 FIPS mode at startup
#include 
void validate_fips_mode() {
    if (FIPS_mode() != 1) {
        std::cerr << "FATAL: OpenSSL FIPS mode not enabled. Set OPENSSL_CONF=/etc/ssl/openssl-fips.cnf" << std::endl;
        exit(EXIT_FAILURE);
    }
    std::cout << "OpenSSL 3.2 FIPS mode validated successfully" << std::endl;
}

apiVersion: batch/v1
kind: CronJob
metadata:
  name: grpc-cert-rotation
  namespace: fintech-grpc
spec:
  schedule: "0 0 * * *" # Run daily
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: cert-rotator
            image: fintech-grpc/cert-rotator:1.0
            env:
            - name: OPENSSL_CONF
              value: /etc/ssl/openssl-fips.cnf
            volumeMounts:
            - name: certs
              mountPath: /certs
          volumes:
          - name: certs
            secret:
              secretName: grpc-certs
          restartPolicy: OnFailure

ghz --insecure=false \
  --cert ./certs/client/client.crt \
  --key ./certs/client/client.key \
  --cacert ./certs/root-ca/ca.crt \
  --proto ./proto/payment.proto \
  --call payment.PaymentProcessor.ProcessPayment \
  -d '{"user_id": "usr_123", "amount": 99.99, "currency": "USD"}' \
  -c 100 \
  -n 100000 \
  localhost:50051

e2ee-grpc-openssl/
├── certs/                  # Generated mTLS certificates (gitignored)
│   ├── root-ca/
│   ├── server/
│   └── client/
├── proto/                  # Protobuf definitions
│   └── payment.proto
├── src/                    # C++ gRPC source code
│   ├── server.cpp
│   ├── client.cpp
│   └── CMakeLists.txt
├── scripts/                # Certificate generation and deployment scripts
│   ├── generate_certs.sh
│   └── rotate_certs.sh
├── k8s/                    # Kubernetes manifests for deployment
│   ├── deployment.yaml
│   ├── service.yaml
│   └── cert-manager.yaml
├── benchmarks/             # ghz benchmark configurations
│   └── payment_bench.json
├── .github/                # CI/CD pipelines
│   └── workflows/
│       ├── build.yml
│       └── compliance.yml
├── CMakeLists.txt          # Root build configuration
└── README.md               # Setup and usage instructions