Configure explicit tls roots for tonic client

Cargo.toml

@@ -35,7 +35,7 @@ thiserror = "1.0.63"
 tokio = { version = "1.39.2", features = ["rt", "rt-multi-thread", "parking_lot", "signal", "sync", "fs"] }
 tokio-rustls = { version = "0.26.0" }
 tokio-stream = { version = "0.1.15", features = ["sync"] }
-tonic = { version = "0.12.1", features = ["tls"] }
+tonic = { version = "0.12.1", features = ["tls", "tls-roots", "tls-webpki-roots"] }
 tower-service = "0.3"
 tracing = "0.1.40"
 tracing-subscriber = { version = "0.3.18", features = ["json", "env-filter"] }

src/clients.rs

@@ -238,7 +238,7 @@ async fn create_grpc_clients<C>(
                     .unwrap_or_else(|error| panic!("error reading key from {key_path:?}: {error}"));
                 let identity = tonic::transport::Identity::from_pem(cert_pem, key_pem);
                 let mut client_tls_config =
-                    tonic::transport::ClientTlsConfig::new().identity(identity);
+                    tonic::transport::ClientTlsConfig::new().identity(identity).with_native_roots().with_webpki_roots();
                 if let Some(client_ca_cert_path) = &tls_config.client_ca_cert_path {
                     let client_ca_cert_pem = tokio::fs::read(client_ca_cert_path)
                         .await

src/main.rs

@@ -44,8 +44,11 @@ struct Args {
 }
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
-    let args = Args::parse();
+    rustls::crypto::aws_lc_rs::default_provider()
+        .install_default()
+        .expect("Failed to install rustls crypto provider");
 
+    let args = Args::parse();
     if args.tls_key_path.is_some() != args.tls_cert_path.is_some() {
         panic!("tls: must provide both cert and key")
     }