grpc 1.28.0 → 1.37.0

data/src/core/lib/security/security_connector/ssl_utils.h

@@ -23,12 +23,14 @@
 
 #include <stdbool.h>
 
+#include "absl/strings/str_split.h"
+#include "absl/strings/string_view.h"
+
 #include <grpc/grpc_security.h>
 #include <grpc/slice_buffer.h>
 
 #include "src/core/lib/gprpp/global_config.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
-#include "src/core/lib/gprpp/string_view.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
 #include "src/core/lib/security/security_connector/ssl_utils_config.h"
@@ -45,17 +47,17 @@
 grpc_error* grpc_ssl_check_alpn(const tsi_peer* peer);
 
 /* Check peer name information returned from SSL handshakes. */
-grpc_error* grpc_ssl_check_peer_name(grpc_core::StringView peer_name,
+grpc_error* grpc_ssl_check_peer_name(absl::string_view peer_name,
                                      const tsi_peer* peer);
 /* Compare targer_name information extracted from SSL security connectors. */
-int grpc_ssl_cmp_target_name(
-    grpc_core::StringView target_name, grpc_core::StringView other_target_name,
-    grpc_core::StringView overridden_target_name,
-    grpc_core::StringView other_overridden_target_name);
+int grpc_ssl_cmp_target_name(absl::string_view target_name,
+                             absl::string_view other_target_name,
+                             absl::string_view overridden_target_name,
+                             absl::string_view other_overridden_target_name);
 /* Check the host that will be set for a call is acceptable.*/
-bool grpc_ssl_check_call_host(grpc_core::StringView host,
-                              grpc_core::StringView target_name,
-                              grpc_core::StringView overridden_target_name,
+bool grpc_ssl_check_call_host(absl::string_view host,
+                              absl::string_view target_name,
+                              absl::string_view overridden_target_name,
                               grpc_auth_context* auth_context,
                               grpc_error** error);
 /* Return HTTP2-compliant cipher suites that gRPC accepts by default. */
@@ -71,6 +73,9 @@ grpc_get_tsi_client_certificate_request_type(
 grpc_security_level grpc_tsi_security_level_string_to_enum(
     const char* security_level);
 
+/* Map grpc_tls_version to tsi_tls_version. */
+tsi_tls_version grpc_get_tsi_tls_version(grpc_tls_version tls_version);
+
 /* Map grpc_security_level enum to a string. */
 const char* grpc_security_level_to_string(grpc_security_level security_level);
 
@@ -84,14 +89,15 @@ const char** grpc_fill_alpn_protocol_strings(size_t* num_alpn_protocols);
 /* Initialize TSI SSL server/client handshaker factory. */
 grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
     tsi_ssl_pem_key_cert_pair* key_cert_pair, const char* pem_root_certs,
-    bool skip_server_certificate_verification,
-    tsi_ssl_session_cache* ssl_session_cache,
+    bool skip_server_certificate_verification, tsi_tls_version min_tls_version,
+    tsi_tls_version max_tls_version, tsi_ssl_session_cache* ssl_session_cache,
     tsi_ssl_client_handshaker_factory** handshaker_factory);
 
 grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
     tsi_ssl_pem_key_cert_pair* key_cert_pairs, size_t num_key_cert_pairs,
     const char* pem_root_certs,
     grpc_ssl_client_certificate_request_type client_certificate_request,
+    tsi_tls_version min_tls_version, tsi_tls_version max_tls_version,
     tsi_ssl_server_handshaker_factory** handshaker_factory);
 
 /* Exposed for testing only. */
@@ -101,7 +107,7 @@ tsi_peer grpc_shallow_peer_from_ssl_auth_context(
     const grpc_auth_context* auth_context);
 void grpc_shallow_peer_destruct(tsi_peer* peer);
 int grpc_ssl_host_matches_name(const tsi_peer* peer,
-                               grpc_core::StringView peer_name);
+                               absl::string_view peer_name);
 
 /* --- Default SSL Root Store. --- */
 namespace grpc_core {
@@ -139,20 +145,15 @@ class DefaultSslRootStore {
 
 class PemKeyCertPair {
  public:
-  // Construct from the C struct.  We steal its members and then immediately
-  // free it.
-  explicit PemKeyCertPair(grpc_ssl_pem_key_cert_pair* pair)
-      : private_key_(const_cast<char*>(pair->private_key)),
-        cert_chain_(const_cast<char*>(pair->cert_chain)) {
-    gpr_free(pair);
-  }
+  PemKeyCertPair(absl::string_view private_key, absl::string_view cert_chain)
+      : private_key_(private_key), cert_chain_(cert_chain) {}
 
   // Movable.
-  PemKeyCertPair(PemKeyCertPair&& other) {
+  PemKeyCertPair(PemKeyCertPair&& other) noexcept {
     private_key_ = std::move(other.private_key_);
     cert_chain_ = std::move(other.cert_chain_);
   }
-  PemKeyCertPair& operator=(PemKeyCertPair&& other) {
+  PemKeyCertPair& operator=(PemKeyCertPair&& other) noexcept {
     private_key_ = std::move(other.private_key_);
     cert_chain_ = std::move(other.cert_chain_);
     return *this;
@@ -160,23 +161,28 @@ class PemKeyCertPair {
 
   // Copyable.
   PemKeyCertPair(const PemKeyCertPair& other)
-      : private_key_(gpr_strdup(other.private_key())),
-        cert_chain_(gpr_strdup(other.cert_chain())) {}
+      : private_key_(other.private_key()), cert_chain_(other.cert_chain()) {}
   PemKeyCertPair& operator=(const PemKeyCertPair& other) {
-    private_key_ = grpc_core::UniquePtr<char>(gpr_strdup(other.private_key()));
-    cert_chain_ = grpc_core::UniquePtr<char>(gpr_strdup(other.cert_chain()));
+    private_key_ = other.private_key();
+    cert_chain_ = other.cert_chain();
     return *this;
   }
 
-  char* private_key() const { return private_key_.get(); }
-  char* cert_chain() const { return cert_chain_.get(); }
+  bool operator==(const PemKeyCertPair& other) const {
+    return this->private_key() == other.private_key() &&
+           this->cert_chain() == other.cert_chain();
+  }
+
+  const std::string& private_key() const { return private_key_; }
+  const std::string& cert_chain() const { return cert_chain_; }
 
  private:
-  grpc_core::UniquePtr<char> private_key_;
-  grpc_core::UniquePtr<char> cert_chain_;
+  std::string private_key_;
+  std::string cert_chain_;
 };
 
+typedef absl::InlinedVector<grpc_core::PemKeyCertPair, 1> PemKeyCertPairList;
+
 }  // namespace grpc_core
 
-#endif /* GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SSL_UTILS_H \
-        */
+#endif  // GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SSL_UTILS_H

data/src/core/lib/security/security_connector/tls/tls_security_connector.cc

@@ -23,6 +23,9 @@
 #include <stdbool.h>
 #include <string.h>
 
+#include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
+
 #include <grpc/grpc.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
@@ -43,7 +46,7 @@ namespace grpc_core {
 namespace {
 
 tsi_ssl_pem_key_cert_pair* ConvertToTsiPemKeyCertPair(
-    const grpc_tls_key_materials_config::PemKeyCertPairList& cert_pair_list) {
+    const grpc_core::PemKeyCertPairList& cert_pair_list) {
   tsi_ssl_pem_key_cert_pair* tsi_pairs = nullptr;
   size_t num_key_cert_pairs = cert_pair_list.size();
   if (num_key_cert_pairs > 0) {
@@ -52,136 +55,155 @@ tsi_ssl_pem_key_cert_pair* ConvertToTsiPemKeyCertPair(
         gpr_zalloc(num_key_cert_pairs * sizeof(tsi_ssl_pem_key_cert_pair)));
   }
   for (size_t i = 0; i < num_key_cert_pairs; i++) {
-    GPR_ASSERT(cert_pair_list[i].private_key() != nullptr);
-    GPR_ASSERT(cert_pair_list[i].cert_chain() != nullptr);
-    tsi_pairs[i].cert_chain = gpr_strdup(cert_pair_list[i].cert_chain());
-    tsi_pairs[i].private_key = gpr_strdup(cert_pair_list[i].private_key());
+    GPR_ASSERT(!cert_pair_list[i].private_key().empty());
+    GPR_ASSERT(!cert_pair_list[i].cert_chain().empty());
+    tsi_pairs[i].cert_chain =
+        gpr_strdup(cert_pair_list[i].cert_chain().c_str());
+    tsi_pairs[i].private_key =
+        gpr_strdup(cert_pair_list[i].private_key().c_str());
   }
   return tsi_pairs;
 }
 
 }  // namespace
 
-/** -- Util function to fetch TLS server/channel credentials. -- */
-grpc_status_code TlsFetchKeyMaterials(
-    const grpc_core::RefCountedPtr<grpc_tls_key_materials_config>&
-        key_materials_config,
-    const grpc_tls_credentials_options& options, bool server_config,
-    grpc_ssl_certificate_config_reload_status* reload_status) {
-  GPR_ASSERT(key_materials_config != nullptr);
-  bool is_key_materials_empty =
-      key_materials_config->pem_key_cert_pair_list().empty();
-  if (options.credential_reload_config() == nullptr && is_key_materials_empty &&
-      server_config) {
+// -------------------channel security connector-------------------
+grpc_core::RefCountedPtr<grpc_channel_security_connector>
+TlsChannelSecurityConnector::CreateTlsChannelSecurityConnector(
+    grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
+    grpc_core::RefCountedPtr<grpc_tls_credentials_options> options,
+    grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
+    const char* target_name, const char* overridden_target_name,
+    tsi_ssl_session_cache* ssl_session_cache) {
+  if (channel_creds == nullptr) {
     gpr_log(GPR_ERROR,
-            "Either credential reload config or key materials should be "
-            "provisioned.");
-    return GRPC_STATUS_FAILED_PRECONDITION;
-  }
-  grpc_status_code status = GRPC_STATUS_OK;
-  /* Use credential reload config to fetch credentials. */
-  if (options.credential_reload_config() != nullptr) {
-    grpc_tls_credential_reload_arg* arg = new grpc_tls_credential_reload_arg();
-    arg->key_materials_config = key_materials_config.get();
-    int result = options.credential_reload_config()->Schedule(arg);
-    if (result) {
-      /* Do not support async credential reload. */
-      gpr_log(GPR_ERROR, "Async credential reload is unsupported now.");
-      status =
-          is_key_materials_empty ? GRPC_STATUS_UNIMPLEMENTED : GRPC_STATUS_OK;
-    } else {
-      GPR_ASSERT(reload_status != nullptr);
-      *reload_status = arg->status;
-      if (arg->status == GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_UNCHANGED) {
-        /* Key materials is not empty. */
-        gpr_log(GPR_DEBUG, "Credential does not change after reload.");
-      } else if (arg->status == GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_FAIL) {
-        gpr_log(GPR_ERROR, "Credential reload failed with an error:");
-        if (arg->error_details != nullptr) {
-          gpr_log(GPR_ERROR, "%s", arg->error_details);
-        }
-        status = is_key_materials_empty ? GRPC_STATUS_INTERNAL : GRPC_STATUS_OK;
-      }
-    }
-    gpr_free((void*)arg->error_details);
-    if (arg->destroy_context != nullptr) {
-      arg->destroy_context(arg->context);
-    }
-    delete arg;
+            "channel_creds is nullptr in "
+            "TlsChannelSecurityConnectorCreate()");
+    return nullptr;
   }
-  return status;
-}
-
-grpc_error* TlsCheckHostName(const char* peer_name, const tsi_peer* peer) {
-  /* Check the peer name if specified. */
-  if (peer_name != nullptr && !grpc_ssl_host_matches_name(peer, peer_name)) {
-    char* msg;
-    gpr_asprintf(&msg, "Peer name %s is not in peer certificate", peer_name);
-    grpc_error* error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
-    gpr_free(msg);
-    return error;
+  if (options == nullptr) {
+    gpr_log(GPR_ERROR,
+            "options is nullptr in "
+            "TlsChannelSecurityConnectorCreate()");
+    return nullptr;
   }
-  return GRPC_ERROR_NONE;
+  if (target_name == nullptr) {
+    gpr_log(GPR_ERROR,
+            "target_name is nullptr in "
+            "TlsChannelSecurityConnectorCreate()");
+    return nullptr;
+  }
+  grpc_core::RefCountedPtr<TlsChannelSecurityConnector> c =
+      grpc_core::MakeRefCounted<TlsChannelSecurityConnector>(
+          std::move(channel_creds), std::move(options),
+          std::move(request_metadata_creds), target_name,
+          overridden_target_name, ssl_session_cache);
+  return c;
 }
 
 TlsChannelSecurityConnector::TlsChannelSecurityConnector(
     grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
+    grpc_core::RefCountedPtr<grpc_tls_credentials_options> options,
     grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-    const char* target_name, const char* overridden_target_name)
+    const char* target_name, const char* overridden_target_name,
+    tsi_ssl_session_cache* ssl_session_cache)
     : grpc_channel_security_connector(GRPC_SSL_URL_SCHEME,
                                       std::move(channel_creds),
                                       std::move(request_metadata_creds)),
-      overridden_target_name_(overridden_target_name == nullptr
-                                  ? nullptr
-                                  : gpr_strdup(overridden_target_name)) {
-  key_materials_config_ = grpc_tls_key_materials_config_create()->Ref();
+      options_(std::move(options)),
+      overridden_target_name_(
+          overridden_target_name == nullptr ? "" : overridden_target_name),
+      ssl_session_cache_(ssl_session_cache) {
+  if (ssl_session_cache_ != nullptr) {
+    tsi_ssl_session_cache_ref(ssl_session_cache_);
+  }
   check_arg_ = ServerAuthorizationCheckArgCreate(this);
-  grpc_core::StringView host;
-  grpc_core::StringView port;
+  absl::string_view host;
+  absl::string_view port;
   grpc_core::SplitHostPort(target_name, &host, &port);
-  target_name_ = grpc_core::StringViewToCString(host);
+  target_name_ = std::string(host);
+  // Create a watcher.
+  auto watcher_ptr = absl::make_unique<TlsChannelCertificateWatcher>(this);
+  certificate_watcher_ = watcher_ptr.get();
+  // Register the watcher with the distributor.
+  grpc_tls_certificate_distributor* distributor =
+      options_->certificate_distributor();
+  absl::optional<std::string> watched_root_cert_name;
+  if (options_->watch_root_cert()) {
+    watched_root_cert_name = options_->root_cert_name();
+  }
+  absl::optional<std::string> watched_identity_cert_name;
+  if (options_->watch_identity_pair()) {
+    watched_identity_cert_name = options_->identity_cert_name();
+  }
+  // We will use the root certs stored in system default locations if not
+  // watching root certs on the client side. We will handle this case
+  // differently here, because "watching a default roots without the identity
+  // certs" is a valid case(and hence we will need to call
+  // OnCertificatesChanged), but it requires nothing from the provider, and
+  // hence no need to register the watcher.
+  bool use_default_roots = !options_->watch_root_cert();
+  if (use_default_roots && !options_->watch_identity_pair()) {
+    watcher_ptr->OnCertificatesChanged(absl::nullopt, absl::nullopt);
+  } else {
+    distributor->WatchTlsCertificates(std::move(watcher_ptr),
+                                      watched_root_cert_name,
+                                      watched_identity_cert_name);
+  }
 }
 
 TlsChannelSecurityConnector::~TlsChannelSecurityConnector() {
+  if (ssl_session_cache_ != nullptr) {
+    tsi_ssl_session_cache_unref(ssl_session_cache_);
+  }
+  // Cancel all the watchers.
+  grpc_tls_certificate_distributor* distributor =
+      options_->certificate_distributor();
+  if (distributor != nullptr) {
+    distributor->CancelTlsCertificatesWatch(certificate_watcher_);
+  }
   if (client_handshaker_factory_ != nullptr) {
     tsi_ssl_client_handshaker_factory_unref(client_handshaker_factory_);
   }
-  if (key_materials_config_.get() != nullptr) {
-    key_materials_config_.get()->Unref();
+  if (check_arg_ != nullptr) {
+    ServerAuthorizationCheckArgDestroy(check_arg_);
   }
-  ServerAuthorizationCheckArgDestroy(check_arg_);
 }
 
 void TlsChannelSecurityConnector::add_handshakers(
     const grpc_channel_args* args, grpc_pollset_set* /*interested_parties*/,
     grpc_core::HandshakeManager* handshake_mgr) {
-  if (RefreshHandshakerFactory() != GRPC_SECURITY_OK) {
-    gpr_log(GPR_ERROR, "Handshaker factory refresh failed.");
-    return;
-  }
-  // Instantiate TSI handshaker.
-  tsi_handshaker* tsi_hs = nullptr;
-  tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
-      client_handshaker_factory_,
-      overridden_target_name_ != nullptr ? overridden_target_name_.get()
-                                         : target_name_.get(),
-      &tsi_hs);
-  if (result != TSI_OK) {
-    gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
-            tsi_result_to_string(result));
+  grpc_core::MutexLock lock(&mu_);
+  if (client_handshaker_factory_ != nullptr) {
+    // Instantiate TSI handshaker.
+    tsi_handshaker* tsi_hs = nullptr;
+    tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
+        client_handshaker_factory_,
+        overridden_target_name_.empty() ? target_name_.c_str()
+                                        : overridden_target_name_.c_str(),
+        &tsi_hs);
+    if (result != TSI_OK) {
+      gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
+              tsi_result_to_string(result));
+      return;
+    }
+    // Create handshakers.
+    handshake_mgr->Add(grpc_core::SecurityHandshakerCreate(tsi_hs, this, args));
     return;
   }
-  // Create handshakers.
-  handshake_mgr->Add(grpc_core::SecurityHandshakerCreate(tsi_hs, this, args));
+  // TODO(ZhenLian): Implement the logic(delegation to
+  // BlockOnInitialCredentialHandshaker) when certificates are not ready.
+  gpr_log(GPR_ERROR, "%s not supported yet.",
+          "Client BlockOnInitialCredentialHandshaker");
 }
 
 void TlsChannelSecurityConnector::check_peer(
     tsi_peer peer, grpc_endpoint* /*ep*/,
     grpc_core::RefCountedPtr<grpc_auth_context>* auth_context,
     grpc_closure* on_peer_checked) {
-  const char* target_name = overridden_target_name_ != nullptr
-                                ? overridden_target_name_.get()
-                                : target_name_.get();
+  const char* target_name = overridden_target_name_.empty()
+                                ? target_name_.c_str()
+                                : overridden_target_name_.c_str();
   grpc_error* error = grpc_ssl_check_alpn(&peer);
   if (error != GRPC_ERROR_NONE) {
     grpc_core::ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
@@ -190,12 +212,9 @@ void TlsChannelSecurityConnector::check_peer(
   }
   *auth_context =
       grpc_ssl_peer_to_auth_context(&peer, GRPC_TLS_TRANSPORT_SECURITY_TYPE);
-  const TlsCredentials* creds =
-      static_cast<const TlsCredentials*>(channel_creds());
-  if (creds->options().server_verification_option() ==
-      GRPC_TLS_SERVER_VERIFICATION) {
+  if (options_->server_verification_option() == GRPC_TLS_SERVER_VERIFICATION) {
     /* Do the default host name check if specifying the target name. */
-    error = TlsCheckHostName(target_name, &peer);
+    error = internal::TlsCheckHostName(target_name, &peer);
     if (error != GRPC_ERROR_NONE) {
       grpc_core::ExecCtx::Run(DEBUG_LOCATION, on_peer_checked, error);
       tsi_peer_destruct(&peer);
@@ -204,7 +223,7 @@ void TlsChannelSecurityConnector::check_peer(
   }
   /* Do the custom server authorization check, if specified by the user. */
   const grpc_tls_server_authorization_check_config* config =
-      creds->options().server_authorization_check_config();
+      options_->server_authorization_check_config();
   /* If server authorization config is not null, use it to perform
    * server authorization check. */
   if (config != nullptr) {
@@ -237,6 +256,39 @@ void TlsChannelSecurityConnector::check_peer(
                 : check_arg_->peer_cert_full_chain;
         gpr_free(peer_pem_chain);
       }
+      // TODO(zhenlian) - This should be cleaned up as part of the custom
+      // verification changes. Fill in the subject alternative names
+      std::vector<char*> subject_alternative_names;
+      for (size_t i = 0; i < peer.property_count; i++) {
+        const tsi_peer_property* prop = &peer.properties[i];
+        if (strcmp(prop->name,
+                   TSI_X509_SUBJECT_ALTERNATIVE_NAME_PEER_PROPERTY) == 0) {
+          char* san = new char[prop->value.length + 1];
+          memcpy(san, prop->value.data, prop->value.length);
+          san[prop->value.length] = '\0';
+          subject_alternative_names.emplace_back(san);
+        }
+      }
+      if (check_arg_->subject_alternative_names != nullptr) {
+        for (size_t i = 0; i < check_arg_->subject_alternative_names_size;
+             ++i) {
+          delete[] check_arg_->subject_alternative_names[i];
+        }
+        delete[] check_arg_->subject_alternative_names;
+      }
+      check_arg_->subject_alternative_names_size =
+          subject_alternative_names.size();
+      if (subject_alternative_names.empty()) {
+        check_arg_->subject_alternative_names = nullptr;
+      } else {
+        check_arg_->subject_alternative_names =
+            new char*[check_arg_->subject_alternative_names_size];
+        for (size_t i = 0; i < check_arg_->subject_alternative_names_size;
+             ++i) {
+          check_arg_->subject_alternative_names[i] =
+              subject_alternative_names[i];
+        }
+      }
       int callback_status = config->Schedule(check_arg_);
       /* Server authorization check is handled asynchronously. */
       if (callback_status) {
@@ -258,16 +310,22 @@ int TlsChannelSecurityConnector::cmp(
   if (c != 0) {
     return c;
   }
-  return grpc_ssl_cmp_target_name(target_name_.get(), other->target_name_.get(),
-                                  overridden_target_name_.get(),
-                                  other->overridden_target_name_.get());
+  return grpc_ssl_cmp_target_name(
+      target_name_.c_str(), other->target_name_.c_str(),
+      overridden_target_name_.c_str(), other->overridden_target_name_.c_str());
 }
 
 bool TlsChannelSecurityConnector::check_call_host(
-    grpc_core::StringView host, grpc_auth_context* auth_context,
-    grpc_closure* on_call_host_checked, grpc_error** error) {
-  return grpc_ssl_check_call_host(host, target_name_.get(),
-                                  overridden_target_name_.get(), auth_context,
+    absl::string_view host, grpc_auth_context* auth_context,
+    grpc_closure* /*on_call_host_checked*/, grpc_error** error) {
+  if (options_->server_verification_option() ==
+          GRPC_TLS_SKIP_HOSTNAME_VERIFICATION ||
+      options_->server_verification_option() ==
+          GRPC_TLS_SKIP_ALL_SERVER_VERIFICATION) {
+    return true;
+  }
+  return grpc_ssl_check_call_host(host, target_name_.c_str(),
+                                  overridden_target_name_.c_str(), auth_context,
                                   error);
 }
 
@@ -276,99 +334,84 @@ void TlsChannelSecurityConnector::cancel_check_call_host(
   GRPC_ERROR_UNREF(error);
 }
 
-grpc_core::RefCountedPtr<grpc_channel_security_connector>
-TlsChannelSecurityConnector::CreateTlsChannelSecurityConnector(
-    grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
-    grpc_core::RefCountedPtr<grpc_call_credentials> request_metadata_creds,
-    const char* target_name, const char* overridden_target_name,
-    tsi_ssl_session_cache* ssl_session_cache) {
-  if (channel_creds == nullptr) {
-    gpr_log(GPR_ERROR,
-            "channel_creds is nullptr in "
-            "TlsChannelSecurityConnectorCreate()");
-    return nullptr;
+void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
+    OnCertificatesChanged(
+        absl::optional<absl::string_view> root_certs,
+        absl::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) {
+  GPR_ASSERT(security_connector_ != nullptr);
+  grpc_core::MutexLock lock(&security_connector_->mu_);
+  if (root_certs.has_value()) {
+    security_connector_->pem_root_certs_ = root_certs;
+  }
+  if (key_cert_pairs.has_value()) {
+    security_connector_->pem_key_cert_pair_list_ = std::move(key_cert_pairs);
+  }
+  const bool root_ready = !security_connector_->options_->watch_root_cert() ||
+                          security_connector_->pem_root_certs_.has_value();
+  const bool identity_ready =
+      !security_connector_->options_->watch_identity_pair() ||
+      security_connector_->pem_key_cert_pair_list_.has_value();
+  if (root_ready && identity_ready) {
+    if (security_connector_->UpdateHandshakerFactoryLocked() !=
+        GRPC_SECURITY_OK) {
+      gpr_log(GPR_ERROR, "Update handshaker factory failed.");
+    }
   }
-  if (target_name == nullptr) {
+}
+
+// TODO(ZhenLian): implement the logic to signal waiting handshakers once
+// BlockOnInitialCredentialHandshaker is implemented.
+void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::OnError(
+    grpc_error* root_cert_error, grpc_error* identity_cert_error) {
+  if (root_cert_error != GRPC_ERROR_NONE) {
     gpr_log(GPR_ERROR,
-            "target_name is nullptr in "
-            "TlsChannelSecurityConnectorCreate()");
-    return nullptr;
+            "TlsChannelCertificateWatcher getting root_cert_error: %s",
+            grpc_error_string(root_cert_error));
   }
-  grpc_core::RefCountedPtr<TlsChannelSecurityConnector> c =
-      grpc_core::MakeRefCounted<TlsChannelSecurityConnector>(
-          std::move(channel_creds), std::move(request_metadata_creds),
-          target_name, overridden_target_name);
-  if (c->InitializeHandshakerFactory(ssl_session_cache) != GRPC_SECURITY_OK) {
-    gpr_log(GPR_ERROR, "Could not initialize client handshaker factory.");
-    return nullptr;
+  if (identity_cert_error != GRPC_ERROR_NONE) {
+    gpr_log(GPR_ERROR,
+            "TlsChannelCertificateWatcher getting identity_cert_error: %s",
+            grpc_error_string(identity_cert_error));
   }
-  return c;
+  GRPC_ERROR_UNREF(root_cert_error);
+  GRPC_ERROR_UNREF(identity_cert_error);
 }
 
-grpc_security_status TlsChannelSecurityConnector::ReplaceHandshakerFactory(
-    tsi_ssl_session_cache* ssl_session_cache) {
-  const TlsCredentials* creds =
-      static_cast<const TlsCredentials*>(channel_creds());
+// TODO(ZhenLian): implement the logic to signal waiting handshakers once
+// BlockOnInitialCredentialHandshaker is implemented.
+grpc_security_status
+TlsChannelSecurityConnector::UpdateHandshakerFactoryLocked() {
   bool skip_server_certificate_verification =
-      creds->options().server_verification_option() ==
+      options_->server_verification_option() ==
       GRPC_TLS_SKIP_ALL_SERVER_VERIFICATION;
   /* Free the client handshaker factory if exists. */
-  if (client_handshaker_factory_) {
+  if (client_handshaker_factory_ != nullptr) {
     tsi_ssl_client_handshaker_factory_unref(client_handshaker_factory_);
   }
-  tsi_ssl_pem_key_cert_pair* pem_key_cert_pair = ConvertToTsiPemKeyCertPair(
-      key_materials_config_->pem_key_cert_pair_list());
+  std::string pem_root_certs;
+  if (pem_root_certs_.has_value()) {
+    // TODO(ZhenLian): update the underlying TSI layer to use C++ types like
+    // std::string and absl::string_view to avoid making another copy here.
+    pem_root_certs = std::string(*pem_root_certs_);
+  }
+  tsi_ssl_pem_key_cert_pair* pem_key_cert_pair = nullptr;
+  if (pem_key_cert_pair_list_.has_value()) {
+    pem_key_cert_pair = ConvertToTsiPemKeyCertPair(*pem_key_cert_pair_list_);
+  }
+  bool use_default_roots = !options_->watch_root_cert();
   grpc_security_status status = grpc_ssl_tsi_client_handshaker_factory_init(
-      pem_key_cert_pair, key_materials_config_->pem_root_certs(),
-      skip_server_certificate_verification, ssl_session_cache,
+      pem_key_cert_pair,
+      pem_root_certs.empty() || use_default_roots ? nullptr
+                                                  : pem_root_certs.c_str(),
+      skip_server_certificate_verification,
+      grpc_get_tsi_tls_version(options_->min_tls_version()),
+      grpc_get_tsi_tls_version(options_->max_tls_version()), ssl_session_cache_,
       &client_handshaker_factory_);
   /* Free memory. */
-  grpc_tsi_ssl_pem_key_cert_pairs_destroy(pem_key_cert_pair, 1);
-  return status;
-}
-
-grpc_security_status TlsChannelSecurityConnector::InitializeHandshakerFactory(
-    tsi_ssl_session_cache* ssl_session_cache) {
-  grpc_core::MutexLock lock(&mu_);
-  const TlsCredentials* creds =
-      static_cast<const TlsCredentials*>(channel_creds());
-  grpc_tls_key_materials_config* key_materials_config =
-      creds->options().key_materials_config();
-  /* Copy key materials config from credential options. */
-  if (key_materials_config != nullptr) {
-    grpc_tls_key_materials_config::PemKeyCertPairList cert_pair_list =
-        key_materials_config->pem_key_cert_pair_list();
-    auto pem_root_certs = grpc_core::UniquePtr<char>(
-        gpr_strdup(key_materials_config->pem_root_certs()));
-    key_materials_config_->set_key_materials(std::move(pem_root_certs),
-                                             std::move(cert_pair_list));
-  }
-  grpc_ssl_certificate_config_reload_status reload_status =
-      GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_UNCHANGED;
-  if (TlsFetchKeyMaterials(key_materials_config_, creds->options(), false,
-                           &reload_status) != GRPC_STATUS_OK) {
-    /* Raise an error if key materials are not populated. */
-    return GRPC_SECURITY_ERROR;
-  }
-  return ReplaceHandshakerFactory(ssl_session_cache);
-}
-
-grpc_security_status TlsChannelSecurityConnector::RefreshHandshakerFactory() {
-  grpc_core::MutexLock lock(&mu_);
-  const TlsCredentials* creds =
-      static_cast<const TlsCredentials*>(channel_creds());
-  grpc_ssl_certificate_config_reload_status reload_status =
-      GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_UNCHANGED;
-  if (TlsFetchKeyMaterials(key_materials_config_, creds->options(), false,
-                           &reload_status) != GRPC_STATUS_OK) {
-    return GRPC_SECURITY_ERROR;
-  }
-  if (reload_status != GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_NEW) {
-    // Re-use existing handshaker factory.
-    return GRPC_SECURITY_OK;
-  } else {
-    return ReplaceHandshakerFactory(nullptr);
+  if (pem_key_cert_pair != nullptr) {
+    grpc_tsi_ssl_pem_key_cert_pairs_destroy(pem_key_cert_pair, 1);
   }
+  return status;
 }
 
 void TlsChannelSecurityConnector::ServerAuthorizationCheckDone(
@@ -384,31 +427,30 @@ void TlsChannelSecurityConnector::ServerAuthorizationCheckDone(
 grpc_error* TlsChannelSecurityConnector::ProcessServerAuthorizationCheckResult(
     grpc_tls_server_authorization_check_arg* arg) {
   grpc_error* error = GRPC_ERROR_NONE;
-  char* msg = nullptr;
   /* Server authorization check is cancelled by caller. */
   if (arg->status == GRPC_STATUS_CANCELLED) {
-    gpr_asprintf(&msg,
-                 "Server authorization check is cancelled by the caller with "
-                 "error: %s",
-                 arg->error_details);
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
+    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("Server authorization check is cancelled by the caller "
+                     "with error: ",
+                     arg->error_details->error_details())
+            .c_str());
   } else if (arg->status == GRPC_STATUS_OK) {
     /* Server authorization check completed successfully but returned check
      * failure. */
     if (!arg->success) {
-      gpr_asprintf(&msg, "Server authorization check failed with error: %s",
-                   arg->error_details);
-      error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
+      error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+          absl::StrCat("Server authorization check failed with error: ",
+                       arg->error_details->error_details())
+              .c_str());
     }
     /* Server authorization check did not complete correctly. */
   } else {
-    gpr_asprintf(
-        &msg,
-        "Server authorization check did not finish correctly with error: %s",
-        arg->error_details);
-    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(msg);
+    error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat(
+            "Server authorization check did not finish correctly with error: ",
+            arg->error_details->error_details())
+            .c_str());
   }
-  gpr_free(msg);
   return error;
 }
 
@@ -417,6 +459,12 @@ TlsChannelSecurityConnector::ServerAuthorizationCheckArgCreate(
     void* user_data) {
   grpc_tls_server_authorization_check_arg* arg =
       new grpc_tls_server_authorization_check_arg();
+  arg->target_name = nullptr;
+  arg->peer_cert = nullptr;
+  arg->peer_cert_full_chain = nullptr;
+  arg->subject_alternative_names = nullptr;
+  arg->subject_alternative_names_size = 0;
+  arg->error_details = new grpc_tls_error_details();
   arg->cb = ServerAuthorizationCheckDone;
   arg->cb_user_data = user_data;
   arg->status = GRPC_STATUS_OK;
@@ -428,50 +476,101 @@ void TlsChannelSecurityConnector::ServerAuthorizationCheckArgDestroy(
   if (arg == nullptr) {
     return;
   }
-  gpr_free((void*)arg->target_name);
-  gpr_free((void*)arg->peer_cert);
-  if (arg->peer_cert_full_chain) gpr_free((void*)arg->peer_cert_full_chain);
-  gpr_free((void*)arg->error_details);
+  gpr_free(const_cast<char*>(arg->target_name));
+  gpr_free(const_cast<char*>(arg->peer_cert));
+  gpr_free(const_cast<char*>(arg->peer_cert_full_chain));
+  for (size_t i = 0; i < arg->subject_alternative_names_size; ++i) {
+    delete[] arg->subject_alternative_names[i];
+  }
+  delete[] arg->subject_alternative_names;
+  delete arg->error_details;
   if (arg->destroy_context != nullptr) {
     arg->destroy_context(arg->context);
   }
   delete arg;
 }
 
+// -------------------server security connector-------------------
+grpc_core::RefCountedPtr<grpc_server_security_connector>
+TlsServerSecurityConnector::CreateTlsServerSecurityConnector(
+    grpc_core::RefCountedPtr<grpc_server_credentials> server_creds,
+    grpc_core::RefCountedPtr<grpc_tls_credentials_options> options) {
+  if (server_creds == nullptr) {
+    gpr_log(GPR_ERROR,
+            "server_creds is nullptr in "
+            "TlsServerSecurityConnectorCreate()");
+    return nullptr;
+  }
+  if (options == nullptr) {
+    gpr_log(GPR_ERROR,
+            "options is nullptr in "
+            "TlsServerSecurityConnectorCreate()");
+    return nullptr;
+  }
+  grpc_core::RefCountedPtr<TlsServerSecurityConnector> c =
+      grpc_core::MakeRefCounted<TlsServerSecurityConnector>(
+          std::move(server_creds), std::move(options));
+  return c;
+}
+
 TlsServerSecurityConnector::TlsServerSecurityConnector(
-    grpc_core::RefCountedPtr<grpc_server_credentials> server_creds)
+    grpc_core::RefCountedPtr<grpc_server_credentials> server_creds,
+    grpc_core::RefCountedPtr<grpc_tls_credentials_options> options)
     : grpc_server_security_connector(GRPC_SSL_URL_SCHEME,
-                                     std::move(server_creds)) {
-  key_materials_config_ = grpc_tls_key_materials_config_create()->Ref();
+                                     std::move(server_creds)),
+      options_(std::move(options)) {
+  // Create a watcher.
+  auto watcher_ptr = absl::make_unique<TlsServerCertificateWatcher>(this);
+  certificate_watcher_ = watcher_ptr.get();
+  // Register the watcher with the distributor.
+  grpc_tls_certificate_distributor* distributor =
+      options_->certificate_distributor();
+  absl::optional<std::string> watched_root_cert_name;
+  if (options_->watch_root_cert()) {
+    watched_root_cert_name = options_->root_cert_name();
+  }
+  absl::optional<std::string> watched_identity_cert_name;
+  if (options_->watch_identity_pair()) {
+    watched_identity_cert_name = options_->identity_cert_name();
+  }
+  // Server side won't use default system roots at any time.
+  distributor->WatchTlsCertificates(std::move(watcher_ptr),
+                                    watched_root_cert_name,
+                                    watched_identity_cert_name);
 }
 
 TlsServerSecurityConnector::~TlsServerSecurityConnector() {
+  // Cancel all the watchers.
+  grpc_tls_certificate_distributor* distributor =
+      options_->certificate_distributor();
+  distributor->CancelTlsCertificatesWatch(certificate_watcher_);
   if (server_handshaker_factory_ != nullptr) {
     tsi_ssl_server_handshaker_factory_unref(server_handshaker_factory_);
   }
-  if (key_materials_config_.get() != nullptr) {
-    key_materials_config_.get()->Unref();
-  }
 }
 
 void TlsServerSecurityConnector::add_handshakers(
     const grpc_channel_args* args, grpc_pollset_set* /*interested_parties*/,
     grpc_core::HandshakeManager* handshake_mgr) {
-  /* Refresh handshaker factory if needed. */
-  if (RefreshHandshakerFactory() != GRPC_SECURITY_OK) {
-    gpr_log(GPR_ERROR, "Handshaker factory refresh failed.");
-    return;
-  }
-  /* Create a TLS TSI handshaker for server. */
-  tsi_handshaker* tsi_hs = nullptr;
-  tsi_result result = tsi_ssl_server_handshaker_factory_create_handshaker(
-      server_handshaker_factory_, &tsi_hs);
-  if (result != TSI_OK) {
-    gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
-            tsi_result_to_string(result));
+  grpc_core::MutexLock lock(&mu_);
+  if (server_handshaker_factory_ != nullptr) {
+    // Instantiate TSI handshaker.
+    tsi_handshaker* tsi_hs = nullptr;
+    tsi_result result = tsi_ssl_server_handshaker_factory_create_handshaker(
+        server_handshaker_factory_, &tsi_hs);
+    if (result != TSI_OK) {
+      gpr_log(GPR_ERROR, "Handshaker creation failed with error %s.",
+              tsi_result_to_string(result));
+      return;
+    }
+    // Create handshakers.
+    handshake_mgr->Add(grpc_core::SecurityHandshakerCreate(tsi_hs, this, args));
     return;
   }
-  handshake_mgr->Add(grpc_core::SecurityHandshakerCreate(tsi_hs, this, args));
+  // TODO(ZhenLian): Implement the logic(delegation to
+  // BlockOnInitialCredentialHandshaker) when certificates are not ready.
+  gpr_log(GPR_ERROR, "%s not supported yet.",
+          "Server BlockOnInitialCredentialHandshaker");
 }
 
 void TlsServerSecurityConnector::check_peer(
@@ -491,87 +590,98 @@ int TlsServerSecurityConnector::cmp(
       static_cast<const grpc_server_security_connector*>(other));
 }
 
-grpc_core::RefCountedPtr<grpc_server_security_connector>
-TlsServerSecurityConnector::CreateTlsServerSecurityConnector(
-    grpc_core::RefCountedPtr<grpc_server_credentials> server_creds) {
-  if (server_creds == nullptr) {
+void TlsServerSecurityConnector::TlsServerCertificateWatcher::
+    OnCertificatesChanged(
+        absl::optional<absl::string_view> root_certs,
+        absl::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) {
+  GPR_ASSERT(security_connector_ != nullptr);
+  grpc_core::MutexLock lock(&security_connector_->mu_);
+  if (root_certs.has_value()) {
+    security_connector_->pem_root_certs_ = root_certs;
+  }
+  if (key_cert_pairs.has_value()) {
+    security_connector_->pem_key_cert_pair_list_ = std::move(key_cert_pairs);
+  }
+  bool root_being_watched = security_connector_->options_->watch_root_cert();
+  bool root_has_value = security_connector_->pem_root_certs_.has_value();
+  bool identity_being_watched =
+      security_connector_->options_->watch_identity_pair();
+  bool identity_has_value =
+      security_connector_->pem_key_cert_pair_list_.has_value();
+  if ((root_being_watched && root_has_value && identity_being_watched &&
+       identity_has_value) ||
+      (root_being_watched && root_has_value && !identity_being_watched) ||
+      (!root_being_watched && identity_being_watched && identity_has_value)) {
+    if (security_connector_->UpdateHandshakerFactoryLocked() !=
+        GRPC_SECURITY_OK) {
+      gpr_log(GPR_ERROR, "Update handshaker factory failed.");
+    }
+  }
+}
+
+// TODO(ZhenLian): implement the logic to signal waiting handshakers once
+// BlockOnInitialCredentialHandshaker is implemented.
+void TlsServerSecurityConnector::TlsServerCertificateWatcher::OnError(
+    grpc_error* root_cert_error, grpc_error* identity_cert_error) {
+  if (root_cert_error != GRPC_ERROR_NONE) {
     gpr_log(GPR_ERROR,
-            "server_creds is nullptr in "
-            "TlsServerSecurityConnectorCreate()");
-    return nullptr;
+            "TlsServerCertificateWatcher getting root_cert_error: %s",
+            grpc_error_string(root_cert_error));
   }
-  grpc_core::RefCountedPtr<TlsServerSecurityConnector> c =
-      grpc_core::MakeRefCounted<TlsServerSecurityConnector>(
-          std::move(server_creds));
-  if (c->InitializeHandshakerFactory() != GRPC_SECURITY_OK) {
-    gpr_log(GPR_ERROR, "Could not initialize server handshaker factory.");
-    return nullptr;
+  if (identity_cert_error != GRPC_ERROR_NONE) {
+    gpr_log(GPR_ERROR,
+            "TlsServerCertificateWatcher getting identity_cert_error: %s",
+            grpc_error_string(identity_cert_error));
   }
-  return c;
+  GRPC_ERROR_UNREF(root_cert_error);
+  GRPC_ERROR_UNREF(identity_cert_error);
 }
 
-grpc_security_status TlsServerSecurityConnector::ReplaceHandshakerFactory() {
-  const TlsServerCredentials* creds =
-      static_cast<const TlsServerCredentials*>(server_creds());
+// TODO(ZhenLian): implement the logic to signal waiting handshakers once
+// BlockOnInitialCredentialHandshaker is implemented.
+grpc_security_status
+TlsServerSecurityConnector::UpdateHandshakerFactoryLocked() {
   /* Free the server handshaker factory if exists. */
-  if (server_handshaker_factory_) {
+  if (server_handshaker_factory_ != nullptr) {
     tsi_ssl_server_handshaker_factory_unref(server_handshaker_factory_);
   }
-  GPR_ASSERT(!key_materials_config_->pem_key_cert_pair_list().empty());
-  tsi_ssl_pem_key_cert_pair* pem_key_cert_pairs = ConvertToTsiPemKeyCertPair(
-      key_materials_config_->pem_key_cert_pair_list());
-  size_t num_key_cert_pairs =
-      key_materials_config_->pem_key_cert_pair_list().size();
+  // The identity certs on the server side shouldn't be empty.
+  GPR_ASSERT(pem_key_cert_pair_list_.has_value());
+  GPR_ASSERT(!(*pem_key_cert_pair_list_).empty());
+  std::string pem_root_certs;
+  if (pem_root_certs_.has_value()) {
+    // TODO(ZhenLian): update the underlying TSI layer to use C++ types like
+    // std::string and absl::string_view to avoid making another copy here.
+    pem_root_certs = std::string(*pem_root_certs_);
+  }
+  tsi_ssl_pem_key_cert_pair* pem_key_cert_pairs = nullptr;
+  pem_key_cert_pairs = ConvertToTsiPemKeyCertPair(*pem_key_cert_pair_list_);
+  size_t num_key_cert_pairs = (*pem_key_cert_pair_list_).size();
   grpc_security_status status = grpc_ssl_tsi_server_handshaker_factory_init(
       pem_key_cert_pairs, num_key_cert_pairs,
-      key_materials_config_->pem_root_certs(),
-      creds->options().cert_request_type(), &server_handshaker_factory_);
+      pem_root_certs.empty() ? nullptr : pem_root_certs.c_str(),
+      options_->cert_request_type(),
+      grpc_get_tsi_tls_version(options_->min_tls_version()),
+      grpc_get_tsi_tls_version(options_->max_tls_version()),
+      &server_handshaker_factory_);
   /* Free memory. */
   grpc_tsi_ssl_pem_key_cert_pairs_destroy(pem_key_cert_pairs,
                                           num_key_cert_pairs);
   return status;
 }
 
-grpc_security_status TlsServerSecurityConnector::InitializeHandshakerFactory() {
-  grpc_core::MutexLock lock(&mu_);
-  const TlsServerCredentials* creds =
-      static_cast<const TlsServerCredentials*>(server_creds());
-  grpc_tls_key_materials_config* key_materials_config =
-      creds->options().key_materials_config();
-  if (key_materials_config != nullptr) {
-    grpc_tls_key_materials_config::PemKeyCertPairList cert_pair_list =
-        key_materials_config->pem_key_cert_pair_list();
-    auto pem_root_certs = grpc_core::UniquePtr<char>(
-        gpr_strdup(key_materials_config->pem_root_certs()));
-    key_materials_config_->set_key_materials(std::move(pem_root_certs),
-                                             std::move(cert_pair_list));
-  }
-  grpc_ssl_certificate_config_reload_status reload_status =
-      GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_UNCHANGED;
-  if (TlsFetchKeyMaterials(key_materials_config_, creds->options(), true,
-                           &reload_status) != GRPC_STATUS_OK) {
-    /* Raise an error if key materials are not populated. */
-    return GRPC_SECURITY_ERROR;
-  }
-  return ReplaceHandshakerFactory();
-}
+namespace internal {
 
-grpc_security_status TlsServerSecurityConnector::RefreshHandshakerFactory() {
-  grpc_core::MutexLock lock(&mu_);
-  const TlsServerCredentials* creds =
-      static_cast<const TlsServerCredentials*>(server_creds());
-  grpc_ssl_certificate_config_reload_status reload_status =
-      GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_UNCHANGED;
-  if (TlsFetchKeyMaterials(key_materials_config_, creds->options(), true,
-                           &reload_status) != GRPC_STATUS_OK) {
-    return GRPC_SECURITY_ERROR;
-  }
-  if (reload_status != GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_NEW) {
-    /* At this point, we should have key materials populated. */
-    return GRPC_SECURITY_OK;
-  } else {
-    return ReplaceHandshakerFactory();
+grpc_error* TlsCheckHostName(const char* peer_name, const tsi_peer* peer) {
+  /* Check the peer name if specified. */
+  if (peer_name != nullptr && !grpc_ssl_host_matches_name(peer, peer_name)) {
+    return GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrCat("Peer name ", peer_name, " is not in peer certificate")
+            .c_str());
   }
+  return GRPC_ERROR_NONE;
 }
 
+}  // namespace internal
+
 }  // namespace grpc_core