Configure JMX on the server side

Use these steps to configure JMX on the server side when enabling secure client-to-node connections using SSL.

There are two files that control Java Virtual Machine (JVM) options:

jvm-server.options: options independent of any particular JVM
jvm11-server.options: options particular to JVM 11

The location of these files depends on your installation type:

Package installations: /etc/hcd/cassandra/
Tarball installations: INSTALLATION_LOCATION/resources/cassandra/conf/

To configure JMX options, do the following:

If the $LOCAL_JMX setting is present, change it to no.
```
"$LOCAL_JMX" = "no"
```
Enable JMX authentication by setting -Dcom.sun.management.jmxremote.authenticate to true:
```
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.authenticate=true
```
Locate the cassandra-env.sh file.

The location of this file depends on your installation type.
- Package installations: /etc/hcd/cassandra/cassandra-env.sh
- Tarball installations: INSTALLATION_LOCATION/resources/cassandra/conf/cassandra-env.sh
Uncomment the following settings in the cassandra-env.sh file. You must specify the path to appropriate keystore and truststore, including passwords for each.

Alternatively, you can use the jvm-server.options file as described in Setting system properties during startup.
```
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl=true"
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.need.client.auth=true"
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.registry.ssl=true"
JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.keyStore=PATH/TO/KEYSTORE.JKS"
JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.keyStorePassword=KEYSTORE-PASSWORD"
JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.trustStore=PATH/TO/TRUSTSTORE.JKS"
JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.trustStorePassword=TRUSTSTORE-PASSWORD"
```
The minimum SSL-related options are as follows:
- com.sun.management.jmxremote.ssl: Set to true to enable SSL for JMX.
- com.sun.management.jmxremote.ssl.need.client.auth: Set to true to enable two-way certificate authentication.
- com.sun.management.jmxremote.registry.ssl: Set to true to create an RMI registry protected by SSL, and configure a management agent when the JVM starts.
Keystore and truststore options depend on your environment and SSL configuration. For more information about these options, see the other SSL documentation for HCD.

Configure JMX on the server side

Was this helpful?

Give Feedback