<p>I have been trying to connect to an LND node using Rust as a language.
I have been constantly be given this error:</p>
<pre><code>tonic::transport::Error(Transport, hyper::Error(Connect, Custom { kind: InvalidData, error: InvalidCertificate(Other(CaUsedAsEndEntity)) }))'
</code></pre>
<p>I decided to take a look and see how <em><a href="https://github.com/lightninglabs/lightning-terminal" rel="nofollow noreferrer">lncli</a></em> (built in golang) does this I encountered this two functions:</p>
<p>NewClientTLSFromFile comes from google.golang.org/grpc/credentials</p>
<p>AppendCertsFromPEM comes from <a href="https://pkg.go.dev/crypto/x509" rel="nofollow noreferrer">https://pkg.go.dev/crypto/x509</a></p>
<pre><code>   # certFile is just the route to the tls.cert provided by LND
  func NewClientTLSFromFile(certFile, serverNameOverride string) (TransportCredentials, error) {
        b, err := ioutil.ReadFile(certFile)
        if err != nil {
            return nil, err
        }
        cp := x509.NewCertPool()
        if !cp.AppendCertsFromPEM(b) {
            return nil, fmt.Errorf(&quot;credentials: failed to append certificates&quot;)
        }
        println(&quot;RootCAs: &quot;, cp)
        return NewTLS(&amp;tls.Config{ServerName: serverNameOverride, RootCAs: cp}), nil
    }

    func (s *CertPool) AppendCertsFromPEM(pemCerts []byte) (ok bool) {
        for len(pemCerts) &gt; 0 {
            var block *pem.Block
            block, pemCerts = pem.Decode(pemCerts)
            if block == nil {
                break
            }
            if block.Type != &quot;CERTIFICATE&quot; || len(block.Headers) != 0 {
                continue
            }
    
            certBytes := block.Bytes
            cert, err := ParseCertificate(certBytes)
            if err != nil {
                continue
            }
            var lazyCert struct {
                sync.Once
                v *Certificate
            }
            s.addCertFunc(sha256.Sum224(cert.Raw), string(cert.RawSubject), func() (*Certificate, error) {
                lazyCert.Do(func() {
                    // This can't fail, as the same bytes already parsed above.
                    lazyCert.v, _ = ParseCertificate(certBytes)
                    certBytes = nil
                })
                return lazyCert.v, nil
            })
            ok = true
        }
    
        return ok
    }
</code></pre>
<p>I have been breaking my head on how to do this in RUST but I haven't been able figure it out.
sorry if this is a bad explanation.</p>

CC BY-SA 4.0
2023-06-17T14:23:38.523Z
Lots and lots and lots of people use Rust to make TLS connections to things other than LND - any of them might solve your problem. They mostly hang out in stackoverflow.com rather than bitcoin.stackexchange.com. That might be a place to get a faster answer.
RedGrittyBrick
CC BY-SA 4.0
2023-06-17T20:42:19.173Z
just did that https://stackoverflow.com/questions/76497734/grpc-connection-error-causedasendentity-using-rust-tonic
thank you for the suggestion!
lescuer
<lightning-network><network><lightning-network-daemon><grpc>
Failed Tls connection to LND with gRPC and REST using rust
lescuer
# Failed Tls connection to LND with gRPC and REST using rust

(Asked by: username_0 on 2023-06-17)

I have been trying to connect to an LND node using Rust as a language.
I have been constantly be given this error:

```
tonic::transport::Error(Transport, hyper::Error(Connect, Custom { kind: InvalidData, error: InvalidCertificate(Other(CaUsedAsEndEntity)) }))'

```

I decided to take a look and see how *[lncli](https://github.com/lightninglabs/lightning-terminal)* (built in golang) does this I encountered this two functions:

NewClientTLSFromFile comes from google.golang.org/grpc/credentials

AppendCertsFromPEM comes from <https://pkg.go.dev/crypto/x509>

```
   # certFile is just the route to the tls.cert provided by LND
  func NewClientTLSFromFile(certFile, serverNameOverride string) (TransportCredentials, error) {
        b, err := ioutil.ReadFile(certFile)
        if err != nil {
            return nil, err
        }
        cp := x509.NewCertPool()
        if !cp.AppendCertsFromPEM(b) {
            return nil, fmt.Errorf("credentials: failed to append certificates")
        }
        println("RootCAs: ", cp)
        return NewTLS(&tls.Config{ServerName: serverNameOverride, RootCAs: cp}), nil
    }

    func (s *CertPool) AppendCertsFromPEM(pemCerts []byte) (ok bool) {
        for len(pemCerts) > 0 {
            var block *pem.Block
            block, pemCerts = pem.Decode(pemCerts)
            if block == nil {
                break
            }
            if block.Type != "CERTIFICATE" || len(block.Headers) != 0 {
                continue
            }
    
            certBytes := block.Bytes
            cert, err := ParseCertificate(certBytes)
            if err != nil {
                continue
            }
            var lazyCert struct {
                sync.Once
                v *Certificate
            }
            s.addCertFunc(sha256.Sum224(cert.Raw), string(cert.RawSubject), func() (*Certificate, error) {
                lazyCert.Do(func() {
                    // This can't fail, as the same bytes already parsed above.
                    lazyCert.v, _ = ParseCertificate(certBytes)
                    certBytes = nil
                })
                return lazyCert.v, nil
            })
            ok = true
        }
    
        return ok
    }

```

I have been breaking my head on how to do this in RUST but I haven't been able figure it out.
sorry if this is a bad explanation.

**Tags:** lightning-network, network, lightning-network-daemon, grpc

> **Comments:**
> **username_1**: Lots and lots and lots of people use Rust to make TLS connections to things other than LND - any of them might solve your problem. They mostly hang out in stackoverflow.com rather than bitcoin.stackexchange.com. That might be a place to get a faster answer.  
> **username_0**: just did that https://stackoverflow.com/questions/76497734/grpc-connection-error-causedasendentity-using-rust-tonic thank you for the suggestion!  

---

## 0 answers

