Configure SSL for node-to-node connections
Node-to-node (internode) encryption protects data in-flight between nodes in a cluster using SSL.
Prerequisites
Create SSL certificates, keystores, and truststores. You can either create local keystore files or use a remote keystore provider.
Procedure
-
Locate the
cassandra.yamlfile.The location of the
cassandra.yamlfile depends on your installation type.-
Package installations:
/etc/hcd/cassandra/cassandra.yaml -
Tarball installations:
INSTALLATION_LOCATION/resources/cassandra/conf/cassandra.yaml
-
-
Edit
cassandra.yamland make the following changes to theserver_encryption_optionssection to enable SSL:-
Set
internode_encryptionto one of the following options to limit which traffic between nodes is encrypted: -
Set
require_client_authtotrueto require two-way host certificate validation. -
Set
require_endpoint_verificationtotrueto verify that the connected node’s IP address matches the certificate.
-
-
Configure the keystore and truststore, depending on whether you are using local keystore files or a remote keystore provider. All settings are configured in the
server_encryption_optionssection ofcassandra.yaml.- Local files
-
Use the following settings:
server_encryption_options: internode_encryption: all keystore_type: JKS keystore: <path_to_keystore.jks> keystore_password: <keystore_password> require_client_auth: true require_endpoint_verification: true truststore_type: JKS truststore: <path_to_truststore.jks> truststore_password: <truststore_password>To encrypt the truststore and keystore passwords for local encryption, see Encrypt tables with Transparent Data Encryption (TDE).
- Remove provider
-
Use the following settings:
server_encryption_options: internode_encryption: all keystore_type: PKCS12 require_client_auth: true require_endpoint_verification: true truststore_type: PKCS12Unused options can be blank or commented out. For more information, see Use a remote keystore provider.
Requires installation of a provider.
