nodetool reloadssl

Reloads dynamic keystores in support of zero downtime certificate authority (CA) rotation.

A CA is a trusted artifact that verifies identities and stores, signs, and issues digital certificates. DSE polls keystore files at regular intervals. Starting with DSE version 5.1.51, you can run nodetool reloadssl to force the system to immediately look for keystore file modifications.

The new certificates must use the existing keystore passwords defined in the cassandra.yaml configuration file. Running the nodetool reloadssl command does not reread this configuration file.

Synopsis

nodetool [(-h <host> | --host <host>)] [(-p <port> | --port <port>)]
                [(-pp | --print-port)] [(-pw <password> | --password <password>)]
                [(-pwf <passwordFilePath> | --password-file <passwordFilePath>)]
                [(-u <username> | --username <username>)] reloadssl

Options

If an option has a short and long form, both forms are given, separated by a comma.

Connection options
Short	Long	Description
`-h`	`--host`	Hostname or IP address.
`-p`	`--port`	Port number.
`-pp`	`--print-port`	Operate in Cassandra version 4.0 mode with hosts distinguished by port number.
`-pwf`	`--password-file`	Password file path.
`-pw`	`--password`	Password.
`-u`	`--username`	Remote JMX agent username.
`--`	Separates an option from an argument that could be mistaken for an option.

Examples

Reload local dynamic keystores

Force an immediate SSL certificate reload on a local node using default credentials:

nodetool reloadssl

Reload remote dynamic keystores

Force an immediate SSL certificate reload on a remote node in the cluster, substituting your system host, username, and password:

nodetool -h 192.168.1.1 -u dse_admin -pw secretPassword reloadssl