grpc 1.83.1 → 1.84.0

data/src/core/credentials/transport/tls/grpc_tls_certificate_provider.cc

@@ -29,6 +29,7 @@
 #include <variant>
 #include <vector>
 
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
 #include "src/core/credentials/transport/tls/spiffe_utils.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
 #include "src/core/lib/debug/trace.h"
@@ -194,20 +195,6 @@ FileWatcherCertificateProvider::FileWatcherCertificateProvider(
       distributor_->SetKeyMaterials(cert_name, roots.ok() ? *roots : nullptr,
                                     pem_key_cert_pairs);
     }
-    grpc_error_handle root_cert_error;
-    grpc_error_handle identity_cert_error;
-    if (root_being_watched && (!roots.ok() || *roots == nullptr)) {
-      root_cert_error =
-          GRPC_ERROR_CREATE("Unable to get latest root certificates.");
-    }
-    if (identity_being_watched && !pem_key_cert_pairs.has_value()) {
-      identity_cert_error =
-          GRPC_ERROR_CREATE("Unable to get latest identity certificates.");
-    }
-    if (!root_cert_error.ok() || !identity_cert_error.ok()) {
-      distributor_->SetErrorForCert(cert_name, root_cert_error,
-                                    identity_cert_error);
-    }
   });
 }
 
@@ -326,8 +313,7 @@ std::optional<std::string>
 FileWatcherCertificateProvider::ReadRootCertificatesFromFile(
     const std::string& root_cert_full_path) {
   // Read the root file.
-  auto root_slice =
-      LoadFile(root_cert_full_path, /*add_null_terminator=*/false);
+  auto root_slice = LoadFile(root_cert_full_path);
   if (!root_slice.ok()) {
     LOG(ERROR) << "Reading file " << root_cert_full_path
                << " failed: " << root_slice.status();
@@ -371,14 +357,13 @@ FileWatcherCertificateProvider::ReadIdentityKeyCertPairFromFiles(
       continue;
     }
     // Read the identity files.
-    auto key_slice = LoadFile(private_key_path, /*add_null_terminator=*/false);
+    auto key_slice = LoadFile(private_key_path);
     if (!key_slice.ok()) {
       LOG(ERROR) << "Reading file " << private_key_path
                  << " failed: " << key_slice.status() << ". Start retrying...";
       continue;
     }
-    auto cert_slice =
-        LoadFile(identity_certificate_path, /*add_null_terminator=*/false);
+    auto cert_slice = LoadFile(identity_certificate_path);
     if (!cert_slice.ok()) {
       LOG(ERROR) << "Reading file " << identity_certificate_path
                  << " failed: " << cert_slice.status() << ". Start retrying...";
@@ -423,7 +408,7 @@ InMemoryCertificateProvider::InMemoryCertificateProvider()
                                               bool identity_being_watched) {
     MutexLock lock(&mu_);
     std::shared_ptr<tsi::RootCertInfo> roots;
-    std::optional<PemKeyCertPairList> pem_key_cert_pairs;
+    std::optional<KeyCertPairsOrSelector> key_cert_pairs_or_selector;
     WatcherInfo& info = watcher_info_[cert_name];
     if (!info.root_being_watched && root_being_watched &&
         root_certificates_.ok() && *root_certificates_ != nullptr) {
@@ -431,36 +416,23 @@ InMemoryCertificateProvider::InMemoryCertificateProvider()
     }
     info.root_being_watched = root_being_watched;
     if (!info.identity_being_watched && identity_being_watched &&
-        !pem_key_cert_pairs_.empty()) {
-      pem_key_cert_pairs = pem_key_cert_pairs_;
+        !IsKeyCertPairsOrSelectorEmpty(key_cert_pairs_or_selector_)) {
+      key_cert_pairs_or_selector = key_cert_pairs_or_selector_;
     }
     info.identity_being_watched = identity_being_watched;
     if (!info.root_being_watched && !info.identity_being_watched) {
       watcher_info_.erase(cert_name);
     }
-    if (roots != nullptr || pem_key_cert_pairs.has_value()) {
-      distributor_->SetKeyMaterials(cert_name, roots, pem_key_cert_pairs);
-    }
-    grpc_error_handle root_cert_error;
-    grpc_error_handle identity_cert_error;
-    if (root_being_watched && roots == nullptr) {
-      root_cert_error =
-          GRPC_ERROR_CREATE("Unable to get latest root certificates.");
-    }
-    if (identity_being_watched && !pem_key_cert_pairs.has_value()) {
-      identity_cert_error =
-          GRPC_ERROR_CREATE("Unable to get latest identity certificates.");
-    }
-    if (!root_cert_error.ok() || !identity_cert_error.ok()) {
-      distributor_->SetErrorForCert(cert_name, root_cert_error,
-                                    identity_cert_error);
+    if (roots != nullptr || key_cert_pairs_or_selector.has_value()) {
+      distributor_->SetKeyMaterials(cert_name, roots,
+                                    key_cert_pairs_or_selector);
     }
   });
 }
 
 absl::Status InMemoryCertificateProvider::Update(
     std::optional<std::shared_ptr<tsi::RootCertInfo>> root_cert_info,
-    std::optional<const PemKeyCertPairList> pem_key_cert_pairs) {
+    std::optional<const KeyCertPairsOrSelector> key_cert_pairs_or_selector) {
   MutexLock lock(&mu_);
   const bool root_changed =
       root_cert_info.has_value() &&
@@ -468,10 +440,11 @@ absl::Status InMemoryCertificateProvider::Update(
   if (root_changed) {
     root_certificates_ = std::move(*root_cert_info);
   }
-  const bool identity_cert_changed = pem_key_cert_pairs.has_value() &&
-                                     pem_key_cert_pairs_ != pem_key_cert_pairs;
+  const bool identity_cert_changed =
+      key_cert_pairs_or_selector.has_value() &&
+      key_cert_pairs_or_selector_ != key_cert_pairs_or_selector;
   if (identity_cert_changed) {
-    pem_key_cert_pairs_ = *pem_key_cert_pairs;
+    key_cert_pairs_or_selector_ = *key_cert_pairs_or_selector;
   }
   if (root_changed || identity_cert_changed) {
     grpc_error_handle root_cert_error =
@@ -482,15 +455,16 @@ absl::Status InMemoryCertificateProvider::Update(
       const std::string& cert_name = p.first;
       const WatcherInfo& info = p.second;
       std::shared_ptr<tsi::RootCertInfo> root_to_report;
-      std::optional<PemKeyCertPairList> identity_to_report;
+      std::optional<KeyCertPairsOrSelector> identity_to_report;
       // Set key materials to the distributor if their contents changed.
       if (info.root_being_watched && root_changed) {
         root_to_report =
             root_certificates_.ok() ? *root_certificates_ : nullptr;
       }
-      if (info.identity_being_watched && !pem_key_cert_pairs_.empty() &&
+      if (info.identity_being_watched &&
+          !IsKeyCertPairsOrSelectorEmpty(key_cert_pairs_or_selector_) &&
           identity_cert_changed) {
-        identity_to_report = pem_key_cert_pairs_;
+        identity_to_report = key_cert_pairs_or_selector_;
       }
       if (root_to_report != nullptr || identity_to_report.has_value()) {
         distributor_->SetKeyMaterials(cert_name, std::move(root_to_report),
@@ -501,7 +475,8 @@ absl::Status InMemoryCertificateProvider::Update(
           info.root_being_watched &&
           (!root_certificates_.ok() || *root_certificates_ == nullptr);
       const bool report_identity_error =
-          info.identity_being_watched && pem_key_cert_pairs_.empty();
+          info.identity_being_watched &&
+          IsKeyCertPairsOrSelectorEmpty(key_cert_pairs_or_selector_);
       if (report_root_error || report_identity_error) {
         distributor_->SetErrorForCert(
             cert_name, report_root_error ? root_cert_error : absl::OkStatus(),
@@ -521,14 +496,28 @@ absl::Status InMemoryCertificateProvider::ValidateCredentials() const {
   if (!status.ok()) {
     return status;
   }
-  for (const PemKeyCertPair& pair : pem_key_cert_pairs_) {
-    absl::Status status =
-        ValidatePemKeyCertPair(pair.cert_chain(), pair.private_key());
-    if (!status.ok()) {
-      return status;
-    }
-  }
-  return absl::OkStatus();
+  return Match(
+      key_cert_pairs_or_selector_,
+      [](const PemKeyCertPairList& pem_pairs) {
+        for (const PemKeyCertPair& pair : pem_pairs) {
+          absl::Status status =
+              ValidatePemKeyCertPair(pair.cert_chain(), pair.private_key());
+          if (!status.ok()) {
+            return status;
+          }
+        }
+        return absl::OkStatus();
+      },
+      [](const std::shared_ptr<CertificateSelector>& cert_selector) {
+#if !defined(OPENSSL_IS_BORINGSSL)
+        return absl::InvalidArgumentError(
+            "Certificate selector is not supported");
+#endif
+        if (cert_selector == nullptr) {
+          return absl::InvalidArgumentError("Certificiate selector is nullptr");
+        }
+        return absl::OkStatus();
+      });
 }
 
 absl::Status InMemoryCertificateProvider::UpdateRoot(
@@ -537,8 +526,8 @@ absl::Status InMemoryCertificateProvider::UpdateRoot(
 }
 
 absl::Status InMemoryCertificateProvider::UpdateIdentityKeyCertPair(
-    const PemKeyCertPairList& pem_key_cert_pairs) {
-  return Update(std::nullopt, pem_key_cert_pairs);
+    const KeyCertPairsOrSelector& key_cert_pairs_or_selector) {
+  return Update(std::nullopt, key_cert_pairs_or_selector);
 }
 
 UniqueTypeName InMemoryCertificateProvider::type() const {

data/src/core/credentials/transport/tls/grpc_tls_certificate_provider.h

@@ -27,6 +27,7 @@
 #include <string>
 
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h"
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
 #include "src/core/util/grpc_check.h"
 #include "src/core/util/ref_counted.h"
@@ -191,7 +192,7 @@ class InMemoryCertificateProvider final : public grpc_tls_certificate_provider {
   // successful.
   absl::Status UpdateRoot(std::shared_ptr<tsi::RootCertInfo> root_certificates);
   absl::Status UpdateIdentityKeyCertPair(
-      const PemKeyCertPairList& pem_key_cert_pairs);
+      const KeyCertPairsOrSelector& key_cert_pairs_or_selector);
 
  private:
   struct WatcherInfo {
@@ -205,15 +206,15 @@ class InMemoryCertificateProvider final : public grpc_tls_certificate_provider {
   }
   absl::Status Update(
       std::optional<std::shared_ptr<tsi::RootCertInfo>> root_cert_info,
-      std::optional<const PemKeyCertPairList> pem_key_cert_pairs);
+      std::optional<const KeyCertPairsOrSelector> key_cert_pairs_or_selector);
 
   RefCountedPtr<grpc_tls_certificate_distributor> distributor_;
 
-  // Guards pem_key_cert_pairs_, root_certificates_ and watcher_info_.
+  // Guards identities_, root_certificates_ and watcher_info_.
   mutable Mutex mu_;
   // The most-recent credential data. It will be empty if the most recent read
   // attempt failed.
-  PemKeyCertPairList pem_key_cert_pairs_ ABSL_GUARDED_BY(mu_);
+  KeyCertPairsOrSelector key_cert_pairs_or_selector_ ABSL_GUARDED_BY(mu_);
   absl::StatusOr<std::shared_ptr<tsi::RootCertInfo>> root_certificates_
       ABSL_GUARDED_BY(mu_);
   // Stores each cert_name we get from the distributor callback and its watcher

data/src/core/credentials/transport/tls/grpc_tls_certificate_selector.h

@@ -41,6 +41,13 @@ class CertificateSelector {
  public:
   struct SelectCertificateInfo {
     std::string sni;
+    // TODO(lwge): Must be removed before this API can be public.
+    struct HandshakeHintsInfo {
+      // The raw ClientHello message.
+      std::string client_hello;
+      // The SSL capabilities string generated by BoringSSL.
+      std::string ssl_capabilities;
+    } handshake_hints_info;
   };
 
   // TODO(lwge): This should be an opaque struct when moved to a public header.
@@ -48,6 +55,25 @@ class CertificateSelector {
     std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> certificate_chain;
     std::variant<bssl::UniquePtr<EVP_PKEY>, std::shared_ptr<PrivateKeySigner>>
         private_key;
+    // TODO(lwge): Must be removed before this API can be public.
+    struct HandshakeHintsResult {
+      // Opaque string generated by BoringSSL. See
+      // https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#Handshake-hints.
+      std::string handshake_hints;
+      // The cipher list (in BoringSSL's mini-language format) to set on the
+      // server-side SSL object. See
+      // https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#Cipher-suite-configuration.
+      std::string cipher_list;
+      // The key exchange groups to set on the server-side SSL object. See
+      // https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#Diffie-Hellman-groups-and-ephemeral-key-exchanges.
+      std::vector<uint16_t> key_exchange_groups;
+      // The minimum TLS version to set on the server-side SSL object. See
+      // https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#Protocol-versions.
+      uint16_t min_tls_version;
+      // The maximum TLS version to set on the server-side SSL object. See
+      // https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#Protocol-versions.
+      uint16_t max_tls_version;
+    } handshake_hints_result;
   };
 
   // Returns a SelectCertificateResult given a DER-encoded certificate chain,

data/src/core/credentials/transport/tls/grpc_tls_crl_provider.cc

@@ -72,7 +72,7 @@ absl::StatusOr<std::string> IssuerFromCrl(X509_CRL* crl) {
 
 absl::StatusOr<std::shared_ptr<Crl>> ReadCrlFromFile(
     const std::string& crl_path) {
-  absl::StatusOr<Slice> crl_slice = LoadFile(crl_path, false);
+  absl::StatusOr<Slice> crl_slice = LoadFile(crl_path);
   if (!crl_slice.ok()) {
     return crl_slice.status();
   }

data/src/core/credentials/transport/tls/load_system_roots.h

@@ -19,16 +19,12 @@
 #ifndef GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_LOAD_SYSTEM_ROOTS_H
 #define GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_LOAD_SYSTEM_ROOTS_H
 
-#include <grpc/slice.h>
-#include <grpc/support/port_platform.h>
+#include "src/core/lib/slice/slice.h"
 
 namespace grpc_core {
 
-// TODO(matthewstevenson88): Update LoadSystemRootCerts to use Slice
-// instead of grpc_slice.
-
 // Returns a slice containing roots from the OS trust store
-grpc_slice LoadSystemRootCerts();
+Slice LoadSystemRootCerts();
 
 }  // namespace grpc_core
 

data/src/core/credentials/transport/tls/load_system_roots_fallback.cc

@@ -22,14 +22,12 @@
     !defined(GPR_APPLE) && !defined(GPR_NETBSD) && !defined(GPR_OPENBSD) &&  \
     !defined(GPR_WINDOWS)
 
-#include <grpc/slice.h>
-#include <grpc/slice_buffer.h>
-
 #include "src/core/credentials/transport/tls/load_system_roots.h"
+#include "src/core/lib/slice/slice.h"
 
 namespace grpc_core {
 
-grpc_slice LoadSystemRootCerts() { return grpc_empty_slice(); }
+Slice LoadSystemRootCerts() { return Slice(); }
 
 }  // namespace grpc_core
 

data/src/core/credentials/transport/tls/load_system_roots_supported.cc

@@ -67,13 +67,13 @@ const char* kCertFiles[] = {"/etc/ssl/cert.pem"};
 const char* kCertDirectories[] = {""};
 #endif                      // GPR_OPENBSD
 
-grpc_slice GetSystemRootCerts() {
+Slice GetSystemRootCerts() {
   size_t num_cert_files_ = GPR_ARRAY_SIZE(kCertFiles);
   for (size_t i = 0; i < num_cert_files_; i++) {
-    auto slice = LoadFile(kCertFiles[i], /*add_null_terminator=*/true);
-    if (slice.ok()) return slice->TakeCSlice();
+    auto slice = LoadFile(kCertFiles[i]);
+    if (slice.ok()) return std::move(*slice);
   }
-  return grpc_empty_slice();
+  return Slice();
 }
 
 }  // namespace
@@ -89,14 +89,13 @@ void GetAbsoluteFilePath(const char* valid_file_dir,
   }
 }
 
-grpc_slice CreateRootCertsBundle(const char* certs_directory) {
-  grpc_slice bundle_slice = grpc_empty_slice();
+Slice CreateRootCertsBundle(const char* certs_directory) {
   if (certs_directory == nullptr) {
-    return bundle_slice;
+    return Slice();
   }
   DIR* ca_directory = opendir(certs_directory);
   if (ca_directory == nullptr) {
-    return bundle_slice;
+    return Slice();
   }
   struct FileData {
     char path[MAXPATHLEN];
@@ -140,12 +139,11 @@ grpc_slice CreateRootCertsBundle(const char* certs_directory) {
       close(file_descriptor);
     }
   }
-  bundle_slice = grpc_slice_new(bundle_string, bytes_read, gpr_free);
-  return bundle_slice;
+  return Slice(grpc_slice_new(bundle_string, bytes_read, gpr_free));
 }
 
-grpc_slice LoadSystemRootCerts() {
-  grpc_slice result = grpc_empty_slice();
+Slice LoadSystemRootCerts() {
+  Slice result;
   // Prioritize user-specified custom directory if flag is set.
   auto custom_dir = ConfigVars::Get().SystemSslRootsDir();
   if (!custom_dir.empty()) {
@@ -153,13 +151,13 @@ grpc_slice LoadSystemRootCerts() {
   }
   // If the custom directory is empty/invalid/not specified, fallback to
   // distribution-specific directory.
-  if (GRPC_SLICE_IS_EMPTY(result)) {
+  if (result.empty()) {
     result = GetSystemRootCerts();
   }
-  if (GRPC_SLICE_IS_EMPTY(result)) {
+  if (result.empty()) {
     for (size_t i = 0; i < GPR_ARRAY_SIZE(kCertDirectories); i++) {
       result = CreateRootCertsBundle(kCertDirectories[i]);
-      if (!GRPC_SLICE_IS_EMPTY(result)) {
+      if (!result.empty()) {
         break;
       }
     }

data/src/core/credentials/transport/tls/load_system_roots_supported.h

@@ -19,9 +19,10 @@
 #ifndef GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_LOAD_SYSTEM_ROOTS_SUPPORTED_H
 #define GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_LOAD_SYSTEM_ROOTS_SUPPORTED_H
 
-#include <grpc/slice.h>
 #include <grpc/support/port_platform.h>
 
+#include "src/core/lib/slice/slice.h"
+
 #if defined(GPR_LINUX) || defined(GPR_FREEBSD) || defined(GPR_APPLE)
 
 namespace grpc_core {
@@ -30,7 +31,7 @@ namespace grpc_core {
 // a directory.
 // Returns such slice.
 // Exposed for testing purposes only.
-grpc_slice CreateRootCertsBundle(const char* certs_directory);
+Slice CreateRootCertsBundle(const char* certs_directory);
 
 // Gets the absolute file path needed to load a certificate file.
 // Populates path_buffer, which must be of size MAXPATHLEN.

data/src/core/credentials/transport/tls/load_system_roots_windows.cc

@@ -23,15 +23,12 @@
 #pragma comment(lib, "crypt32")
 
 #include <esent.h>
-#include <grpc/slice.h>
-#include <grpc/slice_buffer.h>
-#include <grpc/support/alloc.h>
 #include <wincrypt.h>
 
 #include <vector>
 
 #include "src/core/credentials/transport/tls/load_system_roots.h"
-#include "src/core/lib/slice/slice_internal.h"
+#include "src/core/lib/slice/slice.h"
 #include "src/core/util/useful.h"
 
 namespace grpc_core {
@@ -50,13 +47,13 @@ std::string Utf8Encode(const std::wstring& wstr) {
 
 }  // namespace
 
-grpc_slice LoadSystemRootCerts() {
+Slice LoadSystemRootCerts() {
   std::string bundle_string;
 
   // Open root certificate store.
   HANDLE root_cert_store = CertOpenSystemStoreW(NULL, L"ROOT");
   if (!root_cert_store) {
-    return grpc_empty_slice();
+    return Slice();
   }
 
   // Load all root certificates from certificate store.
@@ -74,10 +71,10 @@ grpc_slice LoadSystemRootCerts() {
 
   CertCloseStore(root_cert_store, 0);
   if (bundle_string.size() == 0) {
-    return grpc_empty_slice();
+    return Slice();
   }
 
-  return grpc_slice_from_cpp_string(std::move(bundle_string));
+  return Slice::FromCopiedString(std::move(bundle_string));
 }
 
 }  // namespace grpc_core

data/src/core/credentials/transport/tls/spiffe_utils.cc

@@ -345,7 +345,7 @@ void SpiffeBundleMap::JsonPostLoad(const Json&, const JsonArgs&,
 
 absl::StatusOr<SpiffeBundleMap> SpiffeBundleMap::FromFile(
     absl::string_view file_path) {
-  auto slice = LoadFile(file_path.data(), /*add_null_terminator=*/false);
+  auto slice = LoadFile(file_path.data());
   GRPC_RETURN_IF_ERROR(slice.status());
   auto json = JsonParse(slice->as_string_view());
   GRPC_RETURN_IF_ERROR(json.status());

data/src/core/credentials/transport/tls/ssl_utils.cc

@@ -34,6 +34,7 @@
 #include <vector>
 
 #include "src/core/config/config_vars.h"
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
 #include "src/core/credentials/transport/tls/load_system_roots.h"
 #include "src/core/ext/transport/chttp2/alpn/alpn.h"
 #include "src/core/lib/channel/channel_args.h"
@@ -303,6 +304,10 @@ grpc_core::RefCountedPtr<grpc_auth_context> grpc_ssl_peer_to_auth_context(
       grpc_auth_context_add_property(ctx.get(),
                                      GRPC_SSL_SESSION_REUSED_PROPERTY,
                                      prop->value.data, prop->value.length);
+    } else if (strcmp(prop->name, TSI_SSL_NEGOTIATED_KEY_EXCHANGE_GROUP) == 0) {
+      grpc_auth_context_add_property(
+          ctx.get(), GRPC_SSL_NEGOTIATED_KEY_EXCHANGE_GROUP_PROPERTY_NAME,
+          prop->value.data, prop->value.length);
     } else if (strcmp(prop->name, TSI_SECURITY_LEVEL_PEER_PROPERTY) == 0) {
       grpc_auth_context_add_property(
           ctx.get(), GRPC_TRANSPORT_SECURITY_LEVEL_PROPERTY_NAME,
@@ -418,7 +423,7 @@ void grpc_shallow_peer_destruct(tsi_peer* peer) {
 }
 
 grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
-    tsi_ssl_pem_key_cert_pair* pem_key_cert_pair,
+    const grpc_core::PemKeyCertPair* pem_key_cert_pair,
     std::shared_ptr<tsi::RootCertInfo> root_cert_info,
     bool skip_server_certificate_verification, tsi_tls_version min_tls_version,
     tsi_tls_version max_tls_version, tsi_ssl_session_cache* ssl_session_cache,
@@ -427,7 +432,7 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
     std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider,
     const std::vector<grpc_tls_key_exchange_group>& key_exchange_groups,
     tsi_ssl_client_handshaker_factory** handshaker_factory) {
-  const char* root_certs = nullptr;
+  absl::string_view root_certs;
   const tsi_ssl_root_certs_store* root_store = nullptr;
   tsi_ssl_client_handshaker_options options;
   bool roots_are_configured = root_cert_info != nullptr;
@@ -437,19 +442,20 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
            "default locations instead";
     // Use default root certificates.
     root_certs = grpc_core::DefaultSslRootStore::GetPemRootCerts();
-    if (root_certs == nullptr) {
+    if (root_certs.empty()) {
       LOG(ERROR) << "Could not get default pem root certs.";
       return GRPC_SECURITY_ERROR;
     }
     root_store = grpc_core::DefaultSslRootStore::GetRootStore();
-    options.root_cert_info = std::make_shared<tsi::RootCertInfo>(root_certs);
+    options.root_cert_info =
+        std::make_shared<tsi::RootCertInfo>(std::string(root_certs));
   } else {
     options.root_cert_info = std::move(root_cert_info);
   }
   bool has_key_cert_pair =
       pem_key_cert_pair != nullptr &&
-      !grpc_core::IsPrivateKeyEmpty(pem_key_cert_pair->private_key) &&
-      !pem_key_cert_pair->cert_chain.empty();
+      !grpc_core::IsPrivateKeyEmpty(pem_key_cert_pair->private_key()) &&
+      !pem_key_cert_pair->cert_chain().empty();
   options.root_store = root_store;
   options.alpn_protocols =
       grpc_fill_alpn_protocol_strings(&options.num_alpn_protocols);
@@ -479,7 +485,7 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
 }
 
 grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
-    std::vector<tsi_ssl_pem_key_cert_pair> pem_key_cert_pairs,
+    grpc_core::KeyCertPairsOrSelector key_cert_pairs,
     std::shared_ptr<tsi::RootCertInfo> root_cert_info,
     grpc_ssl_client_certificate_request_type client_certificate_request,
     tsi_tls_version min_tls_version, tsi_tls_version max_tls_version,
@@ -492,7 +498,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
   const char** alpn_protocol_strings =
       grpc_fill_alpn_protocol_strings(&num_alpn_protocols);
   tsi_ssl_server_handshaker_options options;
-  options.pem_key_cert_pairs = pem_key_cert_pairs;
+  options.key_cert_pairs_or_selector = std::move(key_cert_pairs);
   options.client_certificate_request =
       grpc_get_tsi_client_certificate_request_type(client_certificate_request);
   options.cipher_suites = grpc_get_ssl_cipher_suites();
@@ -574,29 +580,25 @@ bool IsPrivateKeyEmpty(const PrivateKey& private_key) {
 }
 
 tsi_ssl_root_certs_store* DefaultSslRootStore::default_root_store_;
-grpc_slice DefaultSslRootStore::default_pem_root_certs_;
+Slice DefaultSslRootStore::default_pem_root_certs_;
 
 const tsi_ssl_root_certs_store* DefaultSslRootStore::GetRootStore() {
   InitRootStore();
   return default_root_store_;
 }
 
-const char* DefaultSslRootStore::GetPemRootCerts() {
+absl::string_view DefaultSslRootStore::GetPemRootCerts() {
   InitRootStore();
-  return GRPC_SLICE_IS_EMPTY(default_pem_root_certs_)
-             ? nullptr
-             : reinterpret_cast<const char*>
-                   GRPC_SLICE_START_PTR(default_pem_root_certs_);
+  return default_pem_root_certs_.as_string_view();
 }
 
-grpc_slice DefaultSslRootStore::ComputePemRootCerts() {
+Slice DefaultSslRootStore::ComputePemRootCerts() {
   Slice result;
   // First try to load the roots from the configuration.
   std::string default_root_certs_path =
       ConfigVars::Get().DefaultSslRootsFilePath();
   if (!default_root_certs_path.empty()) {
-    auto slice =
-        LoadFile(default_root_certs_path, /*add_null_terminator=*/true);
+    auto slice = LoadFile(default_root_certs_path);
     if (!slice.ok()) {
       LOG(ERROR) << "error loading file " << default_root_certs_path << ": "
                  << slice.status();
@@ -607,7 +609,7 @@ grpc_slice DefaultSslRootStore::ComputePemRootCerts() {
   // Try loading roots from OS trust store if preferred over callback.
   if (result.empty() &&
       ConfigVars::Get().UseSystemRootsOverLanguageCallback()) {
-    result = Slice(LoadSystemRootCerts());
+    result = LoadSystemRootCerts();
   }
   // Try overridden roots if needed.
   grpc_ssl_roots_override_result ovrd_res = GRPC_SSL_ROOTS_OVERRIDE_FAIL;
@@ -616,19 +618,17 @@ grpc_slice DefaultSslRootStore::ComputePemRootCerts() {
     ovrd_res = ssl_roots_override_cb(&pem_root_certs);
     if (ovrd_res == GRPC_SSL_ROOTS_OVERRIDE_OK) {
       GRPC_CHECK_NE(pem_root_certs, nullptr);
-      result = Slice::FromCopiedBuffer(
-          pem_root_certs,
-          strlen(pem_root_certs) + 1);  // nullptr terminator.
+      result = Slice::FromCopiedBuffer(pem_root_certs, strlen(pem_root_certs));
     }
     gpr_free(pem_root_certs);
   }
   // Try loading roots from OS trust store if flag is enabled.
   if (result.empty() && !ConfigVars::Get().NotUseSystemSslRoots()) {
-    result = Slice(LoadSystemRootCerts());
+    result = LoadSystemRootCerts();
   }
   // Fallback to roots manually shipped with gRPC.
   if (result.empty() && ovrd_res != GRPC_SSL_ROOTS_OVERRIDE_FAIL_PERMANENTLY) {
-    auto slice = LoadFile(installed_roots_path, /*add_null_terminator=*/true);
+    auto slice = LoadFile(installed_roots_path);
     if (!slice.ok()) {
       LOG(ERROR) << "error loading file " << installed_roots_path << ": "
                  << slice.status();
@@ -636,7 +636,7 @@ grpc_slice DefaultSslRootStore::ComputePemRootCerts() {
       result = std::move(*slice);
     }
   }
-  return result.TakeCSlice();
+  return result;
 }
 
 void DefaultSslRootStore::InitRootStore() {
@@ -646,11 +646,22 @@ void DefaultSslRootStore::InitRootStore() {
 
 void DefaultSslRootStore::InitRootStoreOnce() {
   default_pem_root_certs_ = ComputePemRootCerts();
-  if (!GRPC_SLICE_IS_EMPTY(default_pem_root_certs_)) {
-    default_root_store_ =
-        tsi_ssl_root_certs_store_create(reinterpret_cast<const char*>(
-            GRPC_SLICE_START_PTR(default_pem_root_certs_)));
+  if (!default_pem_root_certs_.empty()) {
+    default_root_store_ = tsi_ssl_root_certs_store_create(
+        default_pem_root_certs_.as_string_view());
   }
 }
 
+bool IsKeyCertPairsOrSelectorEmpty(
+    const KeyCertPairsOrSelector& key_cert_pairs_or_selector) {
+  return Match(
+      key_cert_pairs_or_selector,
+      [](const PemKeyCertPairList& pem_key_cert_pairs) {
+        return pem_key_cert_pairs.empty();
+      },
+      [](const std::shared_ptr<CertificateSelector>& selector) {
+        return selector == nullptr;
+      });
+}
+
 }  // namespace grpc_core