Connection terminated when calling Kalix service

[AlexWeinstein92]

Using v3.0.2

Repro steps

1. Write a proto file using Google GRPC annotations + Kalix annotations
2. Setup a service in Kalix and add client certificate
3. Use curl and grpcurl like so to see expected response from service:

% curl https://my.host.name:443/KalixRoute --key client.private.pem --cert client.crt -d '{"data_type":{}}' -H "Content-Type: application/json"
[ExpectedError1]

% grpcurl -cert client.crt -key iclient.private.pem my.host.name:443 com.my.service.SerivceName/ProtoRoute
[ExpectedError2]

4. Generate client using protoc
5. See clients.dart code below
6. In a ChangeNotifier:

final RouteCommand request = RouteCommand(param: data!.toService());  //toService is a handrolled function to translate from FE domain to client domain
serviceClient!.establishOrganization(request).then((reply) {     //serviceClient was setup in ChangeNotifier constructor succesfully
   print(reply)
   data = [...data, domain.DataType.fromService(reply)];  //fromService is another handrolled function to translate the other way
});

Expected result: being able to see the same kinds of expected errors as in step3, which are programmed into the Kalix service, printed in step 6 - or else the valid response when provided (both have been attempted)
Actual result:

Unhandled Exception: gRPC Error (code: 2, codeName: UNKNOWN, message: HTTP/2 error: Connection error: Connection is being forcefully terminated. (errorCode: 10), details: null, rawResponse: null, trailers: {})

Details

Since the Kalix service can be called with both curl and grpcurl to generate expected error messages, it seems my Dart code is likely the issue here. It is cobbled together from various examples and StackOverflows, so it is likely not all correct.

#clients.dart

ChannelCredentials creds = const ChannelCredentials.secure(authority: 'my.host.name');

Future<Client> setupClient() async {
  ByteData caCert = await rootBundle.load('cert/ca.crt');
  ByteData cert = await rootBundle.load('cert/client.chain.crt');
  ByteData key = await rootBundle.load('cert/client.private.pem');

  creds.securityContext!.setTrustedCertificatesBytes(caCert.buffer.asUint8List(caCert.offsetInBytes, caCert.lengthInBytes,)
      .map((uint8) => uint8.toInt())
      .toList());
  creds.securityContext!.useCertificateChainBytes(cert.buffer.asUint8List(cert.offsetInBytes, cert.lengthInBytes,)
      .map((uint8) => uint8.toInt())
      .toList());
  creds.securityContext!.usePrivateKeyBytes(key.buffer.asUint8List(key.offsetInBytes, key.lengthInBytes,)
      .map((uint8) => uint8.toInt())
      .toList());
  creds.securityContext!.setAlpnProtocols(supportedAlpnProtocols, false);


  ClientChannel channel = ClientChannel(
    'my.host.name',
    port: 443,
    options: ChannelOptions(credentials: creds),
  );
  return MyServiceClient(channel);
}