grpc 1.81.1 → 1.85.0

data/src/core/credentials/transport/ssl/ssl_credentials.h

@@ -37,7 +37,7 @@
 
 class grpc_ssl_credentials : public grpc_channel_credentials {
  public:
-  grpc_ssl_credentials(const char* pem_root_certs,
+  grpc_ssl_credentials(std::string pem_root_certs,
                        grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
                        const grpc_ssl_verify_peer_options* verify_options);
 
@@ -64,7 +64,7 @@ class grpc_ssl_credentials : public grpc_channel_credentials {
         static_cast<const grpc_channel_credentials*>(this), other);
   }
 
-  void build_config(const char* pem_root_certs,
+  void build_config(std::string pem_root_certs,
                     grpc_ssl_pem_key_cert_pair* pem_key_cert_pair,
                     const grpc_ssl_verify_peer_options* verify_options);
 
@@ -74,7 +74,7 @@ class grpc_ssl_credentials : public grpc_channel_credentials {
   // that there is a session cache. If a session cache is used, a new handshaker
   // factory will be created and used that contains that session cache.
   grpc_security_status InitializeClientHandshakerFactory(
-      const grpc_ssl_config* config, const char* pem_root_certs,
+      const grpc_ssl_config* config, std::string pem_root_certs,
       const tsi_ssl_root_certs_store* root_store,
       tsi_ssl_session_cache* ssl_session_cache,
       tsi_ssl_client_handshaker_factory** handshaker_factory);
@@ -88,19 +88,20 @@ class grpc_ssl_credentials : public grpc_channel_credentials {
 struct grpc_ssl_server_certificate_config {
   grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs = nullptr;
   size_t num_key_cert_pairs = 0;
-  char* pem_root_certs = nullptr;
+  std::string pem_root_certs;
+
+  ~grpc_ssl_server_certificate_config();
 };
 
 struct grpc_ssl_server_certificate_config_fetcher {
   grpc_ssl_server_certificate_config_callback cb = nullptr;
-  void* user_data;
+  void* user_data = nullptr;
 };
 
 class grpc_ssl_server_credentials final : public grpc_server_credentials {
  public:
   explicit grpc_ssl_server_credentials(
       const grpc_ssl_server_credentials_options& options);
-  ~grpc_ssl_server_credentials() override;
 
   grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector(const grpc_core::ChannelArgs& /* args */) override;
@@ -129,7 +130,7 @@ class grpc_ssl_server_credentials final : public grpc_server_credentials {
 
  private:
   void build_config(
-      const char* pem_root_certs,
+      std::string pem_root_certs,
       grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs, size_t num_key_cert_pairs,
       grpc_ssl_client_certificate_request_type client_certificate_request);
 
@@ -137,7 +138,7 @@ class grpc_ssl_server_credentials final : public grpc_server_credentials {
   grpc_ssl_server_certificate_config_fetcher certificate_config_fetcher_;
 };
 
-std::vector<tsi_ssl_pem_key_cert_pair> grpc_convert_grpc_to_tsi_cert_pairs(
+grpc_core::PemKeyCertPairList grpc_convert_grpc_to_key_cert_pairs(
     const grpc_ssl_pem_key_cert_pair* pem_key_cert_pairs,
     size_t num_key_cert_pairs);
 

data/src/core/credentials/transport/ssl/ssl_security_connector.cc

@@ -26,6 +26,7 @@
 #include <string>
 #include <utility>
 
+#include "src/core/client_channel/client_channel_args.h"
 #include "src/core/credentials/transport/ssl/ssl_credentials.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
 #include "src/core/credentials/transport/transport_credentials.h"
@@ -39,6 +40,7 @@
 #include "src/core/lib/iomgr/iomgr_fwd.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/promise/promise.h"
+#include "src/core/telemetry/metrics.h"
 #include "src/core/transport/auth_context.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/tsi/transport_security.h"
@@ -103,13 +105,24 @@ class grpc_ssl_channel_security_connector final
                        grpc_core::HandshakeManager* handshake_mgr) override {
     // Instantiate TSI handshaker.
     tsi_handshaker* tsi_hs = nullptr;
+    auto stats_plugin_group = args.GetObject<
+        grpc_core::GlobalStatsPluginRegistry::StatsPluginGroup>();
+    grpc_core::RefCountedPtr<grpc_core::CollectionScope> collection_scope =
+        stats_plugin_group != nullptr ? stats_plugin_group->GetCollectionScope()
+                                      : nullptr;
+    std::string backend_service(
+        args.GetString(GRPC_ARG_BACKEND_SERVICE).value_or(""));
+    std::string locality(args.GetString(GRPC_ARG_LB_LOCALITY).value_or(""));
+    std::string target(args.GetString(GRPC_ARG_SERVER_URI).value_or(""));
     tsi_result result = tsi_ssl_client_handshaker_factory_create_handshaker(
         client_handshaker_factory_,
         overridden_target_name_.empty() ? target_name_.c_str()
                                         : overridden_target_name_.c_str(),
         /*network_bio_buf_size=*/0,
         /*ssl_bio_buf_size=*/0,
-        args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS), &tsi_hs);
+        args.GetOwnedString(GRPC_ARG_TRANSPORT_PROTOCOLS),
+        std::move(collection_scope), std::move(target), std::move(locality),
+        std::move(backend_service), &tsi_hs);
     if (result != TSI_OK) {
       LOG(ERROR) << "Handshaker creation failed with error "
                  << tsi_result_to_string(result);
@@ -239,9 +252,9 @@ class grpc_ssl_server_security_connector
             grpc_fill_alpn_protocol_strings(&num_alpn_protocols);
       }
       tsi_ssl_server_handshaker_options options;
-      options.pem_key_cert_pairs =
+      options.key_cert_pairs_or_selector =
           server_credentials->config().pem_key_cert_pairs;
-      if (server_credentials->config().pem_root_certs != nullptr) {
+      if (!server_credentials->config().pem_root_certs.empty()) {
         options.root_cert_info = std::make_shared<tsi::RootCertInfo>(
             server_credentials->config().pem_root_certs);
       }
@@ -274,9 +287,14 @@ class grpc_ssl_server_security_connector
     // Instantiate TSI handshaker.
     try_fetch_ssl_server_credentials();
     tsi_handshaker* tsi_hs = nullptr;
+    auto stats_plugin_group = args.GetObject<
+        grpc_core::GlobalStatsPluginRegistry::StatsPluginGroup>();
+    grpc_core::RefCountedPtr<grpc_core::CollectionScope> collection_scope =
+        stats_plugin_group != nullptr ? stats_plugin_group->GetCollectionScope()
+                                      : nullptr;
     tsi_result result = tsi_ssl_server_handshaker_factory_create_handshaker(
         server_handshaker_factory_, /*network_bio_buf_size=*/0,
-        /*ssl_bio_buf_size=*/0, &tsi_hs);
+        /*ssl_bio_buf_size=*/0, std::move(collection_scope), &tsi_hs);
     if (result != TSI_OK) {
       LOG(ERROR) << "Handshaker creation failed with error "
                  << tsi_result_to_string(result);
@@ -313,7 +331,7 @@ class grpc_ssl_server_security_connector
     bool status;
     if (!has_cert_config_fetcher()) return false;
 
-    grpc_core::MutexLock lock(&mu_);
+    grpc_core::MutexLock lock(mu_);
     grpc_ssl_server_credentials* server_creds =
         static_cast<grpc_ssl_server_credentials*>(this->mutable_server_creds());
     grpc_ssl_certificate_config_reload_status cb_result =
@@ -355,11 +373,11 @@ class grpc_ssl_server_security_connector
     tsi_ssl_server_handshaker_factory* new_handshaker_factory = nullptr;
     const grpc_ssl_server_credentials* server_creds =
         static_cast<const grpc_ssl_server_credentials*>(this->server_creds());
-    GRPC_DCHECK_NE(config->pem_root_certs, nullptr);
+    GRPC_DCHECK(!config->pem_root_certs.empty());
     tsi_ssl_server_handshaker_options options;
-    options.pem_key_cert_pairs = grpc_convert_grpc_to_tsi_cert_pairs(
+    options.key_cert_pairs_or_selector = grpc_convert_grpc_to_key_cert_pairs(
         config->pem_key_cert_pairs, config->num_key_cert_pairs);
-    if (config->pem_root_certs != nullptr) {
+    if (!config->pem_root_certs.empty()) {
       options.root_cert_info =
           std::make_shared<tsi::RootCertInfo>(config->pem_root_certs);
     }

data/src/core/credentials/transport/ssl/ssl_security_connector.h

@@ -32,8 +32,8 @@
 #include "src/core/util/ref_counted_ptr.h"
 
 struct grpc_ssl_config {
-  tsi_ssl_pem_key_cert_pair pem_key_cert_pair;
-  char* pem_root_certs;
+  grpc_core::PemKeyCertPair pem_key_cert_pair;
+  std::string pem_root_certs;
   verify_peer_options verify_options;
   grpc_tls_version min_tls_version = grpc_tls_version::TLS1_2;
   grpc_tls_version max_tls_version = grpc_tls_version::TLS1_3;
@@ -62,8 +62,8 @@ grpc_ssl_channel_security_connector_create(
 
 // Config for ssl servers.
 struct grpc_ssl_server_config {
-  std::vector<tsi_ssl_pem_key_cert_pair> pem_key_cert_pairs;
-  char* pem_root_certs = nullptr;
+  grpc_core::PemKeyCertPairList pem_key_cert_pairs;
+  std::string pem_root_certs;
   grpc_ssl_client_certificate_request_type client_certificate_request =
       GRPC_SSL_DONT_REQUEST_CLIENT_CERTIFICATE;
   grpc_tls_version min_tls_version = grpc_tls_version::TLS1_2;

data/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.cc

@@ -20,6 +20,7 @@
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>
 
+#include "src/core/credentials/transport/tls/ssl_utils.h"
 #include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/util/grpc_check.h"
 #include "absl/status/status.h"
@@ -30,9 +31,10 @@ bool grpc_tls_certificate_distributor::CertificateInfo::AreRootsEmpty() {
 
 void grpc_tls_certificate_distributor::SetKeyMaterials(
     const std::string& cert_name, std::shared_ptr<tsi::RootCertInfo> roots,
-    std::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs) {
-  GRPC_CHECK(roots != nullptr || pem_key_cert_pairs.has_value());
-  grpc_core::MutexLock lock(&mu_);
+    std::optional<grpc_core::KeyCertPairsOrSelector>
+        key_cert_pairs_or_selector) {
+  GRPC_CHECK(roots != nullptr || key_cert_pairs_or_selector.has_value());
+  grpc_core::MutexLock lock(mu_);
   auto& cert_info = certificate_info_map_[cert_name];
   if (roots != nullptr) {
     // Successful credential updates will clear any pre-existing error.
@@ -42,23 +44,26 @@ void grpc_tls_certificate_distributor::SetKeyMaterials(
       const auto watcher_it = watchers_.find(watcher_ptr);
       GRPC_CHECK(watcher_it != watchers_.end());
       GRPC_CHECK(watcher_it->second.root_cert_name.has_value());
-      std::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs_to_report;
-      if (pem_key_cert_pairs.has_value() &&
+      std::optional<grpc_core::KeyCertPairsOrSelector>
+          key_cert_pairs_or_selector_to_report;
+      if (key_cert_pairs_or_selector.has_value() &&
           watcher_it->second.identity_cert_name == cert_name) {
-        pem_key_cert_pairs_to_report = pem_key_cert_pairs;
+        key_cert_pairs_or_selector_to_report = key_cert_pairs_or_selector;
       } else if (watcher_it->second.identity_cert_name.has_value()) {
         auto& identity_cert_info =
             certificate_info_map_[*watcher_it->second.identity_cert_name];
-        if (!identity_cert_info.pem_key_cert_pairs.empty()) {
-          pem_key_cert_pairs_to_report = identity_cert_info.pem_key_cert_pairs;
+        if (!grpc_core::IsKeyCertPairsOrSelectorEmpty(
+                identity_cert_info.key_cert_pairs_or_selector)) {
+          key_cert_pairs_or_selector_to_report =
+              identity_cert_info.key_cert_pairs_or_selector;
         }
       }
       watcher_ptr->OnCertificatesChanged(
-          roots, std::move(pem_key_cert_pairs_to_report));
+          roots, std::move(key_cert_pairs_or_selector_to_report));
     }
     cert_info.roots = roots;
   }
-  if (pem_key_cert_pairs.has_value()) {
+  if (key_cert_pairs_or_selector.has_value()) {
     // Successful credential updates will clear any pre-existing error.
     cert_info.SetIdentityError(absl::OkStatus());
     for (const auto watcher_ptr : cert_info.identity_cert_watchers) {
@@ -79,25 +84,27 @@ void grpc_tls_certificate_distributor::SetKeyMaterials(
         }
       }
       watcher_ptr->OnCertificatesChanged(std::move(roots_to_report),
-                                         pem_key_cert_pairs);
+                                         key_cert_pairs_or_selector);
     }
-    cert_info.pem_key_cert_pairs = std::move(*pem_key_cert_pairs);
+    cert_info.key_cert_pairs_or_selector =
+        std::move(*key_cert_pairs_or_selector);
   }
 }
 
 bool grpc_tls_certificate_distributor::HasRootCerts(
     const std::string& root_cert_name) {
-  grpc_core::MutexLock lock(&mu_);
+  grpc_core::MutexLock lock(mu_);
   const auto it = certificate_info_map_.find(root_cert_name);
   return it != certificate_info_map_.end() && !it->second.AreRootsEmpty();
 };
 
 bool grpc_tls_certificate_distributor::HasKeyCertPairs(
     const std::string& identity_cert_name) {
-  grpc_core::MutexLock lock(&mu_);
+  grpc_core::MutexLock lock(mu_);
   const auto it = certificate_info_map_.find(identity_cert_name);
   return it != certificate_info_map_.end() &&
-         !it->second.pem_key_cert_pairs.empty();
+         !grpc_core::IsKeyCertPairsOrSelectorEmpty(
+             it->second.key_cert_pairs_or_selector);
 };
 
 void grpc_tls_certificate_distributor::SetErrorForCert(
@@ -105,7 +112,7 @@ void grpc_tls_certificate_distributor::SetErrorForCert(
     std::optional<grpc_error_handle> root_cert_error,
     std::optional<grpc_error_handle> identity_cert_error) {
   GRPC_CHECK(root_cert_error.has_value() || identity_cert_error.has_value());
-  grpc_core::MutexLock lock(&mu_);
+  grpc_core::MutexLock lock(mu_);
   CertificateInfo& cert_info = certificate_info_map_[cert_name];
   if (root_cert_error.has_value()) {
     for (auto* watcher_ptr : cert_info.root_cert_watchers) {
@@ -153,7 +160,7 @@ void grpc_tls_certificate_distributor::SetErrorForCert(
 
 void grpc_tls_certificate_distributor::SetError(grpc_error_handle error) {
   GRPC_CHECK(!error.ok());
-  grpc_core::MutexLock lock(&mu_);
+  grpc_core::MutexLock lock(mu_);
   for (const auto& watcher : watchers_) {
     const auto watcher_ptr = watcher.first;
     GRPC_CHECK_NE(watcher_ptr, nullptr);
@@ -182,7 +189,7 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
   GRPC_CHECK_NE(watcher_ptr, nullptr);
   // Update watchers_ and certificate_info_map_.
   {
-    grpc_core::MutexLock lock(&mu_);
+    grpc_core::MutexLock lock(mu_);
     const auto watcher_it = watchers_.find(watcher_ptr);
     // The caller needs to cancel the watcher first if it wants to re-register
     // the watcher.
@@ -190,7 +197,8 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
     watchers_[watcher_ptr] = {std::move(watcher), root_cert_name,
                               identity_cert_name};
     std::shared_ptr<tsi::RootCertInfo> updated_roots;
-    std::optional<grpc_core::PemKeyCertPairList> updated_identity_pairs;
+    std::optional<grpc_core::KeyCertPairsOrSelector>
+        updated_key_cert_pairs_or_selector;
     grpc_error_handle root_error;
     grpc_error_handle identity_error;
     if (root_cert_name.has_value()) {
@@ -213,8 +221,10 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
       cert_info.identity_cert_watchers.insert(watcher_ptr);
       identity_error = cert_info.identity_cert_error;
       // Empty credentials will be treated as no updates.
-      if (!cert_info.pem_key_cert_pairs.empty()) {
-        updated_identity_pairs = cert_info.pem_key_cert_pairs;
+      if (!grpc_core::IsKeyCertPairsOrSelectorEmpty(
+              cert_info.key_cert_pairs_or_selector)) {
+        updated_key_cert_pairs_or_selector =
+            cert_info.key_cert_pairs_or_selector;
       }
     }
     // Notify this watcher if the certs it is watching already had some
@@ -222,9 +232,10 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
     // occurred while trying to fetch the latest cert, but the updated_*_certs
     // should always be valid. So we will send the updates regardless of
     // *_cert_error.
-    if (updated_roots != nullptr || updated_identity_pairs.has_value()) {
-      watcher_ptr->OnCertificatesChanged(updated_roots,
-                                         std::move(updated_identity_pairs));
+    if (updated_roots != nullptr ||
+        updated_key_cert_pairs_or_selector.has_value()) {
+      watcher_ptr->OnCertificatesChanged(
+          updated_roots, std::move(updated_key_cert_pairs_or_selector));
     }
     // Notify this watcher if the certs it is watching already had some
     // errors.
@@ -234,7 +245,7 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
   }
   // Invoke watch status callback if needed.
   {
-    grpc_core::MutexLock lock(&callback_mu_);
+    grpc_core::MutexLock lock(callback_mu_);
     if (watch_status_callback_ != nullptr) {
       if (root_cert_name == identity_cert_name &&
           (start_watching_root_cert || start_watching_identity_cert)) {
@@ -264,7 +275,7 @@ void grpc_tls_certificate_distributor::CancelTlsCertificatesWatch(
   bool already_watching_root_for_identity_cert = false;
   // Update watchers_ and certificate_info_map_.
   {
-    grpc_core::MutexLock lock(&mu_);
+    grpc_core::MutexLock lock(mu_);
     auto it = watchers_.find(watcher);
     if (it == watchers_.end()) return;
     WatcherInfo& watcher_info = it->second;
@@ -299,7 +310,7 @@ void grpc_tls_certificate_distributor::CancelTlsCertificatesWatch(
   }
   // Invoke watch status callback if needed.
   {
-    grpc_core::MutexLock lock(&callback_mu_);
+    grpc_core::MutexLock lock(callback_mu_);
     if (watch_status_callback_ != nullptr) {
       if (root_cert_name == identity_cert_name &&
           (stop_watching_root_cert || stop_watching_identity_cert)) {

data/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h

@@ -62,7 +62,8 @@ struct grpc_tls_certificate_distributor
     // pairs.
     virtual void OnCertificatesChanged(
         std::shared_ptr<tsi::RootCertInfo> roots,
-        std::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) = 0;
+        std::optional<grpc_core::KeyCertPairsOrSelector>
+            key_cert_pairs_or_selector) = 0;
 
     // Handles an error that occurs while attempting to fetch certificate data.
     // Note that if a watcher sees an error, it simply means the Provider is
@@ -88,9 +89,10 @@ struct grpc_tls_certificate_distributor
   // @param roots The content of the roots, either the pem root certificates or
   // the SpiffeBundleMap.
   // @param pem_key_cert_pairs The content of identity key-cert pairs.
-  void SetKeyMaterials(
-      const std::string& cert_name, std::shared_ptr<tsi::RootCertInfo> roots,
-      std::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs);
+  void SetKeyMaterials(const std::string& cert_name,
+                       std::shared_ptr<tsi::RootCertInfo> roots,
+                       std::optional<grpc_core::KeyCertPairsOrSelector>
+                           key_cert_pairs_or_selector);
 
   bool HasRootCerts(const std::string& root_cert_name);
 
@@ -136,7 +138,7 @@ struct grpc_tls_certificate_distributor
   // are being watched.
   void SetWatchStatusCallback(
       std::function<void(std::string, bool, bool)> callback) {
-    grpc_core::MutexLock lock(&callback_mu_);
+    grpc_core::MutexLock lock(callback_mu_);
     watch_status_callback_ = std::move(callback);
   };
 
@@ -177,8 +179,9 @@ struct grpc_tls_certificate_distributor
   struct CertificateInfo {
     // The contents of the root certificates.
     std::shared_ptr<tsi::RootCertInfo> roots;
-    // The contents of the identity key-certificate pairs.
-    grpc_core::PemKeyCertPairList pem_key_cert_pairs;
+    // The contents of the identity key-certificate pairs or a certificate
+    // selector.
+    grpc_core::KeyCertPairsOrSelector key_cert_pairs_or_selector;
     // TODO(gtcooke94) Swap to using absl::StatusOr<>
     // https://github.com/grpc/grpc/pull/39708/files#r2144014200 The root cert
     // reloading error propagated by the caller.

data/src/core/credentials/transport/tls/grpc_tls_certificate_provider.cc

@@ -29,6 +29,7 @@
 #include <variant>
 #include <vector>
 
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
 #include "src/core/credentials/transport/tls/spiffe_utils.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
 #include "src/core/lib/debug/trace.h"
@@ -171,7 +172,7 @@ FileWatcherCertificateProvider::FileWatcherCertificateProvider(
   distributor_->SetWatchStatusCallback([this](std::string cert_name,
                                               bool root_being_watched,
                                               bool identity_being_watched) {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     absl::StatusOr<std::shared_ptr<tsi::RootCertInfo>> roots = nullptr;
     std::optional<PemKeyCertPairList> pem_key_cert_pairs;
     FileWatcherCertificateProvider::WatcherInfo& info =
@@ -194,20 +195,6 @@ FileWatcherCertificateProvider::FileWatcherCertificateProvider(
       distributor_->SetKeyMaterials(cert_name, roots.ok() ? *roots : nullptr,
                                     pem_key_cert_pairs);
     }
-    grpc_error_handle root_cert_error;
-    grpc_error_handle identity_cert_error;
-    if (root_being_watched && (!roots.ok() || *roots == nullptr)) {
-      root_cert_error =
-          GRPC_ERROR_CREATE("Unable to get latest root certificates.");
-    }
-    if (identity_being_watched && !pem_key_cert_pairs.has_value()) {
-      identity_cert_error =
-          GRPC_ERROR_CREATE("Unable to get latest identity certificates.");
-    }
-    if (!root_cert_error.ok() || !identity_cert_error.ok()) {
-      distributor_->SetErrorForCert(cert_name, root_cert_error,
-                                    identity_cert_error);
-    }
   });
 }
 
@@ -225,7 +212,7 @@ UniqueTypeName FileWatcherCertificateProvider::type() const {
 }
 
 absl::Status FileWatcherCertificateProvider::ValidateCredentials() const {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (!root_cert_info_.ok()) {
     return root_cert_info_.status();
   }
@@ -267,7 +254,7 @@ void FileWatcherCertificateProvider::ForceUpdate() {
     pem_key_cert_pairs = ReadIdentityKeyCertPairFromFiles(
         private_key_path_, identity_certificate_path_);
   }
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   const bool root_changed =
       HasRootCertInfoChanged(root_cert_info_, root_cert_info);
   if (root_changed) {
@@ -326,8 +313,7 @@ std::optional<std::string>
 FileWatcherCertificateProvider::ReadRootCertificatesFromFile(
     const std::string& root_cert_full_path) {
   // Read the root file.
-  auto root_slice =
-      LoadFile(root_cert_full_path, /*add_null_terminator=*/false);
+  auto root_slice = LoadFile(root_cert_full_path);
   if (!root_slice.ok()) {
     LOG(ERROR) << "Reading file " << root_cert_full_path
                << " failed: " << root_slice.status();
@@ -371,14 +357,13 @@ FileWatcherCertificateProvider::ReadIdentityKeyCertPairFromFiles(
       continue;
     }
     // Read the identity files.
-    auto key_slice = LoadFile(private_key_path, /*add_null_terminator=*/false);
+    auto key_slice = LoadFile(private_key_path);
     if (!key_slice.ok()) {
       LOG(ERROR) << "Reading file " << private_key_path
                  << " failed: " << key_slice.status() << ". Start retrying...";
       continue;
     }
-    auto cert_slice =
-        LoadFile(identity_certificate_path, /*add_null_terminator=*/false);
+    auto cert_slice = LoadFile(identity_certificate_path);
     if (!cert_slice.ok()) {
       LOG(ERROR) << "Reading file " << identity_certificate_path
                  << " failed: " << cert_slice.status() << ". Start retrying...";
@@ -421,9 +406,9 @@ InMemoryCertificateProvider::InMemoryCertificateProvider()
   distributor_->SetWatchStatusCallback([this](std::string cert_name,
                                               bool root_being_watched,
                                               bool identity_being_watched) {
-    MutexLock lock(&mu_);
+    MutexLock lock(mu_);
     std::shared_ptr<tsi::RootCertInfo> roots;
-    std::optional<PemKeyCertPairList> pem_key_cert_pairs;
+    std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector;
     WatcherInfo& info = watcher_info_[cert_name];
     if (!info.root_being_watched && root_being_watched &&
         root_certificates_.ok() && *root_certificates_ != nullptr) {
@@ -431,47 +416,35 @@ InMemoryCertificateProvider::InMemoryCertificateProvider()
     }
     info.root_being_watched = root_being_watched;
     if (!info.identity_being_watched && identity_being_watched &&
-        !pem_key_cert_pairs_.empty()) {
-      pem_key_cert_pairs = pem_key_cert_pairs_;
+        !IsKeyCertPairsOrSelectorEmpty(key_cert_pairs_or_selector_)) {
+      key_cert_pairs_or_selector = key_cert_pairs_or_selector_;
     }
     info.identity_being_watched = identity_being_watched;
     if (!info.root_being_watched && !info.identity_being_watched) {
       watcher_info_.erase(cert_name);
     }
-    if (roots != nullptr || pem_key_cert_pairs.has_value()) {
-      distributor_->SetKeyMaterials(cert_name, roots, pem_key_cert_pairs);
-    }
-    grpc_error_handle root_cert_error;
-    grpc_error_handle identity_cert_error;
-    if (root_being_watched && roots == nullptr) {
-      root_cert_error =
-          GRPC_ERROR_CREATE("Unable to get latest root certificates.");
-    }
-    if (identity_being_watched && !pem_key_cert_pairs.has_value()) {
-      identity_cert_error =
-          GRPC_ERROR_CREATE("Unable to get latest identity certificates.");
-    }
-    if (!root_cert_error.ok() || !identity_cert_error.ok()) {
-      distributor_->SetErrorForCert(cert_name, root_cert_error,
-                                    identity_cert_error);
+    if (roots != nullptr || key_cert_pairs_or_selector.has_value()) {
+      distributor_->SetKeyMaterials(cert_name, roots,
+                                    key_cert_pairs_or_selector);
     }
   });
 }
 
 absl::Status InMemoryCertificateProvider::Update(
     std::optional<std::shared_ptr<tsi::RootCertInfo>> root_cert_info,
-    std::optional<const PemKeyCertPairList> pem_key_cert_pairs) {
-  MutexLock lock(&mu_);
+    std::optional<const KeyCertPairsOrSelector> key_cert_pairs_or_selector) {
+  MutexLock lock(mu_);
   const bool root_changed =
       root_cert_info.has_value() &&
       HasRootCertInfoChanged(root_certificates_, *root_cert_info);
   if (root_changed) {
     root_certificates_ = std::move(*root_cert_info);
   }
-  const bool identity_cert_changed = pem_key_cert_pairs.has_value() &&
-                                     pem_key_cert_pairs_ != pem_key_cert_pairs;
+  const bool identity_cert_changed =
+      key_cert_pairs_or_selector.has_value() &&
+      key_cert_pairs_or_selector_ != key_cert_pairs_or_selector;
   if (identity_cert_changed) {
-    pem_key_cert_pairs_ = *pem_key_cert_pairs;
+    key_cert_pairs_or_selector_ = *key_cert_pairs_or_selector;
   }
   if (root_changed || identity_cert_changed) {
     grpc_error_handle root_cert_error =
@@ -482,15 +455,16 @@ absl::Status InMemoryCertificateProvider::Update(
       const std::string& cert_name = p.first;
       const WatcherInfo& info = p.second;
       std::shared_ptr<tsi::RootCertInfo> root_to_report;
-      std::optional<PemKeyCertPairList> identity_to_report;
+      std::optional<KeyCertPairsOrSelector> identity_to_report;
       // Set key materials to the distributor if their contents changed.
       if (info.root_being_watched && root_changed) {
         root_to_report =
             root_certificates_.ok() ? *root_certificates_ : nullptr;
       }
-      if (info.identity_being_watched && !pem_key_cert_pairs_.empty() &&
+      if (info.identity_being_watched &&
+          !IsKeyCertPairsOrSelectorEmpty(key_cert_pairs_or_selector_) &&
           identity_cert_changed) {
-        identity_to_report = pem_key_cert_pairs_;
+        identity_to_report = key_cert_pairs_or_selector_;
       }
       if (root_to_report != nullptr || identity_to_report.has_value()) {
         distributor_->SetKeyMaterials(cert_name, std::move(root_to_report),
@@ -501,7 +475,8 @@ absl::Status InMemoryCertificateProvider::Update(
           info.root_being_watched &&
           (!root_certificates_.ok() || *root_certificates_ == nullptr);
       const bool report_identity_error =
-          info.identity_being_watched && pem_key_cert_pairs_.empty();
+          info.identity_being_watched &&
+          IsKeyCertPairsOrSelectorEmpty(key_cert_pairs_or_selector_);
       if (report_root_error || report_identity_error) {
         distributor_->SetErrorForCert(
             cert_name, report_root_error ? root_cert_error : absl::OkStatus(),
@@ -513,7 +488,7 @@ absl::Status InMemoryCertificateProvider::Update(
 }
 
 absl::Status InMemoryCertificateProvider::ValidateCredentials() const {
-  MutexLock lock(&mu_);
+  MutexLock lock(mu_);
   if (!root_certificates_.ok()) {
     return root_certificates_.status();
   }
@@ -521,14 +496,28 @@ absl::Status InMemoryCertificateProvider::ValidateCredentials() const {
   if (!status.ok()) {
     return status;
   }
-  for (const PemKeyCertPair& pair : pem_key_cert_pairs_) {
-    absl::Status status =
-        ValidatePemKeyCertPair(pair.cert_chain(), pair.private_key());
-    if (!status.ok()) {
-      return status;
-    }
-  }
-  return absl::OkStatus();
+  return Match(
+      key_cert_pairs_or_selector_,
+      [](const PemKeyCertPairList& pem_pairs) {
+        for (const PemKeyCertPair& pair : pem_pairs) {
+          absl::Status status =
+              ValidatePemKeyCertPair(pair.cert_chain(), pair.private_key());
+          if (!status.ok()) {
+            return status;
+          }
+        }
+        return absl::OkStatus();
+      },
+      [](const std::shared_ptr<CertificateSelector>& cert_selector) {
+#if !defined(OPENSSL_IS_BORINGSSL)
+        return absl::InvalidArgumentError(
+            "Certificate selector is not supported");
+#endif
+        if (cert_selector == nullptr) {
+          return absl::InvalidArgumentError("Certificiate selector is nullptr");
+        }
+        return absl::OkStatus();
+      });
 }
 
 absl::Status InMemoryCertificateProvider::UpdateRoot(
@@ -537,8 +526,8 @@ absl::Status InMemoryCertificateProvider::UpdateRoot(
 }
 
 absl::Status InMemoryCertificateProvider::UpdateIdentityKeyCertPair(
-    const PemKeyCertPairList& pem_key_cert_pairs) {
-  return Update(std::nullopt, pem_key_cert_pairs);
+    const KeyCertPairsOrSelector& key_cert_pairs_or_selector) {
+  return Update(std::nullopt, key_cert_pairs_or_selector);
 }
 
 UniqueTypeName InMemoryCertificateProvider::type() const {