[PSU-1420] fix(agent): use TLS for PSU gRPC over HTTPS

[Adam Driscoll (adamdriscoll)]

The Devolutions Agent can now register with PowerShell Universal over HTTPS. Previously, its gRPC client sent plaintext HTTP/2 to HTTPS endpoints because tonic TLS support was disabled and endpoint construction did not configure TLS from the URL. The connection now uses native certificate roots for HTTPS while retaining plaintext HTTP support.

A regression test reproduced the plaintext preface before the fix and verifies a TLS ClientHello afterward. All 76 Agent library tests and workspace Clippy pass. Against isolated PSU 2026.3.1.0, the locally built Linux Agent registered over trusted-certificate HTTPS; an untrusted certificate was rejected, and HTTP gRPC registration still worked. The full workspace test run could not pass on this Windows host: an unrelated example hit a linker file lock, and three package-broker reparse-point tests require a privilege this process lacks.

Issue: PSU-1420

[Adam Driscoll (adamdriscoll)]

Implementation notes:

• Enabled tonic native-root TLS and used its scheme-aware endpoint constructor, so HTTPS performs TLS negotiation and validates the server certificate; HTTP remains plaintext HTTP/2.
• Selected the existing Agent rustls ring provider before creating the TLS endpoint because other dependencies enable multiple crypto providers.
• Added a wire-level regression: before the fix the HTTPS client sent the HTTP/2 P byte; after the fix it starts a TLS ClientHello (0x16).
• Verified PSU 2026.3.1.0 registration from the locally built Linux image with a trusted certificate and Agent-role token. An untrusted certificate was rejected, and HTTP registration still succeeded. No migration or insecure certificate override is required.
• All 76 Agent library tests and workspace Clippy passed. The full workspace test run is limited by unrelated Windows example linker and package-broker privilege failures.

Note

LLM-assisted content (no human feedback).

[github-actions]

Let maintainers know that an action is required on their side

• Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)

• Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release

• Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)

• Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation correctly enables trusted TLS for HTTPS without regressing plaintext HTTP support.

Review effort: Balanced
Findings: None

What changed in this PR

Enables secure PSU gRPC registration over HTTPS while preserving HTTP compatibility.

Changes:

• Enables tonic TLS with native certificate roots.
• Builds scheme-aware PSU endpoints and adds protocol regression tests.
• Documents HTTPS certificate trust requirements.

File	Description
devolutions-agent/​Cargo.toml	Enables tonic native-root TLS.
devolutions-agent/​src/​psu_agent/​mod.rs	Configures HTTPS endpoints and tests TLS/HTTP behavior.
Cargo.lock	Records new TLS dependencies.
package/​AgentLinux/​README.md	Documents HTTPS container setup.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.