Enabling SSL encryption for DSEFS

There are two parts to enabling SSL encryption for the DataStax Enterprise File System (DSEFS):

  • Node-to-node encryption

  • Client-to-node encryption

Enabling node-to-node encryption in DSE automatically enables encrypted communication between DSEFS nodes. DSE nodes with client-to-node encryption enabled allow SSL connections from the DSEFS shell.

Configuring the DSEFS shell to use SSL encryption

In most cases, you don’t need to add any DSEFS shell settings to connect using SSL. If a ~/.dse/dsefs-shell.yaml configuration file cannot be found, DSEFS shell attempts to load server-side configuration and SSL settings from DSE configuration files.

To manually configure SSL, create and edit the DSEFS shell configuration file. The DSEFS shell is configured in the ~/.dse/dsefs-shell.yaml configuration file. Add the following settings to enable SSL encryption:

  enabled: true
  optional: true
  require_client_auth: false

The same settings can be given as dse fs command-line options, except keystore_password, truststore_password, and cipher_suites. If passwords are not given in the configuration file, they will be prompted for at the DSEFS shell startup. The command line options override settings read from the configuration file.

If a non-optional secure connection is established, a [secure] flag will appear in the prompt of the DSEFS shell.


Whether to enable client-to-node encryption.

Default: false


When optional is selected, both encrypted and unencrypted connections over native transport are allowed. That is a necessary transition state to facilitate enabling client to node encryption on live clusters without inducing an outage for existing unencrypted clients. Typically, once existing clients are migrated to encrypted connections, optional is unselected in order to enforce native transport encryption.

Default: false


Relative path from DSE installation directory or absolute path to truststore containing the trusted certificate for authenticating remote servers.

Default: resources/dse/conf/.truststore


Valid types are JKS, JCEKS, and PKCS12.

Default: commented out (JKS)


Password for the truststore. This must match the password used when generating the keystore and truststore.

Truststore password and path is only required when require_client_auth is set to true in cassandra.yaml.

Default: cassandra


Valid types are JKS, JCEKS, and PKCS12. For file-based keystores, use PKCS12.

Default: commented out (JKS)


Relative path from DSE installation directory or absolute path to the Java keystore (JKS) suitable for use with Java Secure Socket Extension (JSSE), which is the Java version of the Secure Sockets Layer (SSL), and Transport Layer Security (TLS) protocols. The keystore contains the private key used to encrypt outgoing messages.

Default: resources/dse/conf/.keystore


Password for the keystore.

Default: cassandra


Default: commented out (TLS)


Default: commented out (SunX509)


Supported ciphers:







Default: commented out


Whether to enable certificate authentication for client-to-node encryption. When not set, the default is false.

When set to true, client certificates must be present on all nodes in the cluster.

Default: commented out (false)

Was this helpful?

Give Feedback

How can we improve the documentation?

© 2024 DataStax | Privacy policy | Terms of use

Apache, Apache Cassandra, Cassandra, Apache Tomcat, Tomcat, Apache Lucene, Apache Solr, Apache Hadoop, Hadoop, Apache Pulsar, Pulsar, Apache Spark, Spark, Apache TinkerPop, TinkerPop, Apache Kafka and Kafka are either registered trademarks or trademarks of the Apache Software Foundation or its subsidiaries in Canada, the United States and/or other countries. Kubernetes is the registered trademark of the Linux Foundation.

General Inquiries: +1 (650) 389-6000, info@datastax.com