Reference: SSL instruction variables

Directory where the root certificate is created and stored. DataStax recommends securing this directory, ideally on a computer isolated from the network.

Root CA configuration file.

Title for the section containing the Distinguished Name (DN) properties for the CA.

Password for the generated file used to sign certificates.

Two letter country code, such as <US> for United States or <JP> for Japan.

Name of your organization.

Name of your DataStax Enterprise (DSE) cluster.

Common Name (CN) for the root CA.

Key file for the root CA certificate.

Certificate used to sign (authorize) DSE node SSL certificates.

Truststore that contains the root certificate. Use the same root certificate truststore on all nodes.

Keystore for the individual node.

Password used to protect the individual private key.

Password used to protect the private key of the key pair.

Password required to access the keystore.

Location where the certificate file for each DSE node is created. Typically, SSL certificates and keys are generated on a secure system that is isolated from the network.

Fully Qualified Domain Name (FQDN) of the node, such as ip-10-200-182-183.example.com. When using the FQDN as the node_name, you can add the IP address as a subject alternative name (SAN) so that the certificate protects the IP address in addition to the domain name.

If the domain name is the node_name for the CA, add san=ip:ip_address to the -ext option. Using the IP address as a subject alternative name (SAN) ensures that the certificate protects the IP address in addition to the domain name. For example:

-ext "san=ip:10.200.100.52"

Certificate signing request (CSR) that is passed to the Certificate Authority (CA) to sign the certificate. The CSR typically includes the public key plus associated metadata such as the Common Name (CN), Organization (O), Organization Unit (OU), and Country (C).

The signed certificate file to create, using the certificate signing request (CSR) (signing_request.csr) as the input file.

If you use the domain name as the <node_name> and the node IP address as a Subject Alternative Name (SAN), then create a temporary configuration file and pass it in using the -extfile option. In the configuration file, use the subjectAltName parameter to specify the DNS and IP. For example:

subjectAltName=DNS:<node_name>,IP:<node_ip_address>

subjectAltName=DNS:domain1,IP:10.200.100.52
subjectAltName=DNS:domain1,IP:10.200.101.63
subjectAltName=DNS:domain1,IP:10.200.111.74
subjectAltName=DNS:domain1,IP:10.200.121.85