Configure SSL for HCD
Configure SSL for Hyper-Converged Database (HCD) by implementing Client Certificate Authentication. Following this approach, each node verifies the service or client making a request against a local truststore to validate that the certificate was issued by a known Certificate Authority (CA).
-
Create SSL certificates, keystores, and truststores.
You can implement SSL using CA signed certificates signed by well-known CAs, or by creating your own root CA. DataStax recommends using certificates signed by a CA to reduce SSL certificate management tasks. However, you can use self-signed certificates with HCD, which supports SSL certificates in local and external keystores.
Creating your own CA in a production environments typically involves using an intermediary certificate chain, where the root CA signs one or more intermediate certificates with its private key. These intermediary certificates chain together to link back to the root CA, which owns one or more trusted roots.
-
Encrypt HCD services: Use SSL to encrypt data in node-to-node connections.
-
Encrypt HCD clients: Use SSL to secure client-to-node connections:
-
Apache Cassandra drivers
-
DataStax Bulk Loader (DSBulk)
-
DataStax Apache Kafka Connector
-
HCD tools
Connections to clusters through a Mission Control CQL gateway use a gateway Secure Connect Bundle (SCB) that automatically configures SSL for client-to-node connections.
-
