Is the Glowroot Collector protocol secure?

[David Mulligan]

Hi Trask,

I am a new Glowroot user and I would like to start by saying thank you for this great tool.  I am amazed by how simple and useful it is. 

I anticipate the need to run the Glowroot collector outside of our DMZ.  I also anticipate getting this question from our IT team.  According to the documentation grpc communicates over HTTP/2 so is the grpc protocol itself secure?   There can potentially be sensitive information in the request parameters and possibly other data I haven't thought of.

Thanks again,

David

[Trask Stalnaker]

Hi David,

Thanks for the kind words.

Currently the gRPC communication is not secure.  You will want to follow https://github.com/glowroot/glowroot/issues/205, I've been working on this locally and it should be available in the next month or so.

Trask

[Trask Stalnaker]

gRPC over HTTPS is now supported in version 0.9.27. For configuration instructions, see https://github.com/glowroot/glowroot/wiki/Central-Collector-Installation#agent-communication-over-https (and if using a Central Collector Cluster also see https://github.com/glowroot/glowroot/wiki/Central-Collector-Cluster#option-2-client-side-load-balancing-if-using-grpc-over-https).

Thanks,

Traks