Enable TLS support for gRPC client

[romac]

Closes: #877

Description

Enable TLS support in Tonic, and add system trust roots to gRPC client.

How to test

To test this, we can use an HTTPS reverse proxy in front of the gRPC endpoint of one of the chains.

1. Install Caddy

$ brew install caddy

2. Start the chains with the dev-env scripts

3. Paste the following in a file named Caddyfile

localhost:2020

log {
    level DEBUG
}

reverse_proxy {
    to 127.0.0.1:9090

    transport http {
        versions h2c 2
    }
}

4. Start Caddy in a new terminal window

$ caddy run

Caddy may prompt you for your password to install a local-only root CA.
We will remove this CA in step 8.

5. In the Hermes config, change the grpc_addr of chain ibc-0 from http://127.0.0.1:9090 to https://localhost:2020

6. Create a channel between ibc-0 and ibc-1:

$ hermes create channel ibc-0 ibc-1 --port-a transfer --port-b transfer -o unordered

7. The command should succeed and you should see the proxied requests in the terminal window running Caddy.

8. Run the following command to remove Caddy's root CA (it's a local-only CA so it should be safe but better remove it anyway if not in use)

$ caddy untrust

---

For contributor use:

• Updated the Unreleased section of CHANGELOG.md with the issue.
• If applicable: Unit tests written, added test to CI.
• Linked to Github issue with discussion and accepted design OR link to spec that describes this work.
• Updated relevant documentation (docs/) and code comments.
• Re-reviewed Files changed in the Github PR explorer.

[adizere]

Managed to test, the instructions were very good, great work @romac !

[faddat]

Does hermes reject non-https connections?

I am getting:

Error: chain runtime error: event monitor error: failed to create WebSocket driver: WebSocket Error: WebSocket protocol error: invalid HTTP version (code: 1)

[adizere]

Hi,

This issue concerns the gRPC client, parametrized by the Hermes config.toml grpc_addr option.

https://github.com/informalsystems/ibc-rs/blob/47899196c271f523a1db395202d77072beaa0593/config.toml#L47-L48

It seems like the error you're signalling is from the websocket client. This is the websocket_addr option.

https://github.com/informalsystems/ibc-rs/blob/47899196c271f523a1db395202d77072beaa0593/config.toml#L50-L52

To try to debug this, would you consider sharing your configuration file, at least the relevant options?