fix: resolve TLS handshake failure in inter-node communication (#1201) (#1222)

Co-authored-by: houseme <housemecn@gmail.com>

crates/common/src/globals.rs

@@ -24,11 +24,16 @@ pub static GLOBAL_RUSTFS_HOST: LazyLock<RwLock<String>> = LazyLock::new(|| RwLoc
 pub static GLOBAL_RUSTFS_PORT: LazyLock<RwLock<String>> = LazyLock::new(|| RwLock::new("9000".to_string()));
 pub static GLOBAL_RUSTFS_ADDR: LazyLock<RwLock<String>> = LazyLock::new(|| RwLock::new("".to_string()));
 pub static GLOBAL_CONN_MAP: LazyLock<RwLock<HashMap<String, Channel>>> = LazyLock::new(|| RwLock::new(HashMap::new()));
+pub static GLOBAL_ROOT_CERT: LazyLock<RwLock<Option<Vec<u8>>>> = LazyLock::new(|| RwLock::new(None));
 
 pub async fn set_global_addr(addr: &str) {
     *GLOBAL_RUSTFS_ADDR.write().await = addr.to_string();
 }
 
+pub async fn set_global_root_cert(cert: Vec<u8>) {
+    *GLOBAL_ROOT_CERT.write().await = Some(cert);
+}
+
 /// Evict a stale/dead connection from the global connection cache.
 /// This is critical for cluster recovery when a node dies unexpectedly (e.g., power-off).
 /// By removing the cached connection, subsequent requests will establish a fresh connection.

crates/config/src/constants/app.rs

@@ -89,6 +89,30 @@ pub const RUSTFS_TLS_KEY: &str = "rustfs_key.pem";
 /// This is the default cert for TLS.
 pub const RUSTFS_TLS_CERT: &str = "rustfs_cert.pem";
 
+/// Default public certificate filename for rustfs
+/// This is the default public certificate filename for rustfs.
+/// It is used to store the public certificate of the application.
+/// Default value: public.crt
+pub const RUSTFS_PUBLIC_CERT: &str = "public.crt";
+
+/// Default CA certificate filename for rustfs
+/// This is the default CA certificate filename for rustfs.
+/// It is used to store the CA certificate of the application.
+/// Default value: ca.crt
+pub const RUSTFS_CA_CERT: &str = "ca.crt";
+
+/// Default HTTP prefix for rustfs
+/// This is the default HTTP prefix for rustfs.
+/// It is used to identify HTTP URLs.
+/// Default value: http://
+pub const RUSTFS_HTTP_PREFIX: &str = "http://";
+
+/// Default HTTPS prefix for rustfs
+/// This is the default HTTPS prefix for rustfs.
+/// It is used to identify HTTPS URLs.
+/// Default value: https://
+pub const RUSTFS_HTTPS_PREFIX: &str = "https://";
+
 /// Default port for rustfs
 /// This is the default port for rustfs.
 /// This is used to bind the server to a specific port.

crates/config/src/constants/tls.rs

@@ -12,4 +12,26 @@
 //  See the License for the specific language governing permissions and
 //  limitations under the License.
 
+/// TLS related environment variable names and default values
+/// Environment variable to enable TLS key logging
+/// When set to "1", RustFS will log TLS keys to the specified file for debugging purposes.
+/// By default, this is disabled.
+/// To enable, set the environment variable RUSTFS_TLS_KEYLOG=1
 pub const ENV_TLS_KEYLOG: &str = "RUSTFS_TLS_KEYLOG";
+
+/// Default value for TLS key logging
+/// By default, RustFS does not log TLS keys.
+/// To change this behavior, set the environment variable RUSTFS_TLS_KEYLOG=1
+pub const DEFAULT_TLS_KEYLOG: bool = false;
+
+/// Environment variable to trust system CA certificates
+/// When set to "1", RustFS will trust system CA certificates in addition to any
+/// custom CA certificates provided in the configuration.
+/// By default, this is disabled.
+/// To enable, set the environment variable RUSTFS_TRUST_SYSTEM_CA=1
+pub const ENV_TRUST_SYSTEM_CA: &str = "RUSTFS_TRUST_SYSTEM_CA";
+
+/// Default value for trusting system CA certificates
+/// By default, RustFS does not trust system CA certificates.
+/// To change this behavior, set the environment variable RUSTFS_TRUST_SYSTEM_CA=1
+pub const DEFAULT_TRUST_SYSTEM_CA: bool = false;

crates/protos/src/lib.rs

@@ -15,19 +15,19 @@
 #[allow(unsafe_code)]
 mod generated;
 
-use std::{error::Error, time::Duration};
-
-pub use generated::*;
 use proto_gen::node_service::node_service_client::NodeServiceClient;
-use rustfs_common::globals::{GLOBAL_CONN_MAP, evict_connection};
+use rustfs_common::globals::{GLOBAL_CONN_MAP, GLOBAL_ROOT_CERT, evict_connection};
+use std::{error::Error, time::Duration};
 use tonic::{
     Request, Status,
     metadata::MetadataValue,
     service::interceptor::InterceptedService,
-    transport::{Channel, Endpoint},
+    transport::{Certificate, Channel, ClientTlsConfig, Endpoint},
 };
 use tracing::{debug, warn};
 
+pub use generated::*;
+
 // Default 100 MB
 pub const DEFAULT_GRPC_SERVER_MESSAGE_LEN: usize = 100 * 1024 * 1024;
 
@@ -46,6 +46,12 @@ const HTTP2_KEEPALIVE_TIMEOUT_SECS: u64 = 3;
 /// Overall RPC timeout - maximum time for any single RPC operation
 const RPC_TIMEOUT_SECS: u64 = 30;
 
+/// Default HTTPS prefix for rustfs
+/// This is the default HTTPS prefix for rustfs.
+/// It is used to identify HTTPS URLs.
+/// Default value: https://
+const RUSTFS_HTTPS_PREFIX: &str = "https://";
+
 /// Creates a new gRPC channel with optimized keepalive settings for cluster resilience.
 ///
 /// This function is designed to detect dead peers quickly:
@@ -56,7 +62,7 @@ const RPC_TIMEOUT_SECS: u64 = 30;
 async fn create_new_channel(addr: &str) -> Result<Channel, Box<dyn Error>> {
     debug!("Creating new gRPC channel to: {}", addr);
 
-    let connector = Endpoint::from_shared(addr.to_string())?
+    let mut connector = Endpoint::from_shared(addr.to_string())?
         // Fast connection timeout for dead peer detection
         .connect_timeout(Duration::from_secs(CONNECT_TIMEOUT_SECS))
         // TCP-level keepalive - OS will probe connection
@@ -70,6 +76,37 @@ async fn create_new_channel(addr: &str) -> Result<Channel, Box<dyn Error>> {
         // Overall timeout for any RPC - fail fast on unresponsive peers
         .timeout(Duration::from_secs(RPC_TIMEOUT_SECS));
 
+    let root_cert = GLOBAL_ROOT_CERT.read().await;
+    if addr.starts_with(RUSTFS_HTTPS_PREFIX) {
+        if let Some(cert_pem) = root_cert.as_ref() {
+            let ca = Certificate::from_pem(cert_pem);
+            // Derive the hostname from the HTTPS URL for TLS hostname verification.
+            let domain = addr
+                .trim_start_matches(RUSTFS_HTTPS_PREFIX)
+                .split('/')
+                .next()
+                .unwrap_or("")
+                .split(':')
+                .next()
+                .unwrap_or("");
+            let tls = if !domain.is_empty() {
+                ClientTlsConfig::new().ca_certificate(ca).domain_name(domain)
+            } else {
+                // Fallback: configure TLS without explicit domain if parsing fails.
+                ClientTlsConfig::new().ca_certificate(ca)
+            };
+            connector = connector.tls_config(tls)?;
+            debug!("Configured TLS with custom root certificate for: {}", addr);
+        } else {
+            debug!("Using system root certificates for TLS: {}", addr);
+        }
+    } else {
+        // Custom root certificates are configured but will be ignored for non-HTTPS addresses.
+        if root_cert.is_some() {
+            warn!("Custom root certificates are configured but not used because the address does not use HTTPS: {addr}");
+        }
+    }
+
     let channel = connector.connect().await?;
 
     // Cache the new connection

crates/utils/src/certs.rs

@@ -21,7 +21,7 @@ use std::collections::HashMap;
 use std::io::Error;
 use std::path::Path;
 use std::sync::Arc;
-use std::{env, fs, io};
+use std::{fs, io};
 use tracing::{debug, warn};
 
 /// Load public certificate from file.
@@ -243,17 +243,7 @@ pub fn create_multi_cert_resolver(
 /// * A boolean indicating whether TLS key logging is enabled based on the `RUSTFS_TLS_KEYLOG` environment variable.
 ///
 pub fn tls_key_log() -> bool {
-    env::var("RUSTFS_TLS_KEYLOG")
-        .map(|v| {
-            let v = v.trim();
-            v.eq_ignore_ascii_case("1")
-                || v.eq_ignore_ascii_case("on")
-                || v.eq_ignore_ascii_case("true")
-                || v.eq_ignore_ascii_case("yes")
-                || v.eq_ignore_ascii_case("enabled")
-                || v.eq_ignore_ascii_case("t")
-        })
-        .unwrap_or(false)
+    crate::get_env_bool(rustfs_config::ENV_TLS_KEYLOG, rustfs_config::DEFAULT_TLS_KEYLOG)
 }
 
 #[cfg(test)]