Configure SSL for node-to-node connections

Node-to-node (internode) encryption protects data in-flight between nodes in a cluster using SSL.

Prerequisites

Create SSL certificates, keystores, and truststores. You can either create local keystore files, use a remote keystore provider, or use PEM files directly.

Procedure

  1. Locate the cassandra.yaml file.

    The location of the cassandra.yaml file depends on your installation type:

    • Package installations: /etc/hcd/cassandra/cassandra.yaml

    • Tarball installations: INSTALL_DIRECTORY/resources/cassandra/conf/cassandra.yaml

  2. Edit cassandra.yaml and make the following changes to the server_encryption_options section to enable SSL:

    1. Set internode_encryption to one of the following options to limit which traffic between nodes is encrypted:

    2. Set require_client_auth to true to require two-way host certificate validation.

    3. Set require_endpoint_verification to true to verify that the connected node’s IP address matches the certificate.

  3. Configure the keystore and truststore, depending on whether you are using local keystore files or a remote keystore provider. All settings are configured in the server_encryption_options section of cassandra.yaml.

    Local files

    Use the following settings:

    server_encryption_options:
    internode_encryption: all
    keystore_type: JKS
    keystore: KEYSTORE_PATH
    keystore_password: KEYSTORE_PASSWORD
    require_client_auth: true
    require_endpoint_verification: true
    truststore_type: JKS
    truststore: TRUSTSTORE_PATH
    truststore_password: TRUSTSTORE_PASSWORD

    Replace the following:

    • KEYSTORE_PATH: The path to the JKS keystore file.

    • KEYSTORE_PASSWORD: The password for the keystore.

    • TRUSTSTORE_PATH: The path to the JKS truststore file.

    • TRUSTSTORE_PASSWORD: The password for the truststore.

      To encrypt the truststore and keystore passwords for local encryption, see Encrypt tables with Transparent Data Encryption (TDE).
    Remote keystore provider

    Use the following settings:

    server_encryption_options:
   internode_encryption: all
   keystore_type: PKCS12
   require_client_auth: true
   require_endpoint_verification: true
   truststore_type: PKCS12

    Unused options can be blank or commented out. For more information, see Use a remote keystore provider.

    Requires installation of a provider.
    PEM files

    Use the following settings:

    server_encryption_options:
    internode_encryption: all
    require_client_auth: true
    require_endpoint_verification: true
    ssl_context_factory:
        class_name: org.apache.cassandra.security.PEMBasedSslContextFactory
        parameters:
            private_key: PRIVATE_KEY_PATH
            private_key_password: PRIVATE_KEY_PASSWORD
            trusted_certificates: TRUSTED_CERTIFICATES_PATH

    Replace the following:

    • PRIVATE_KEY_PATH: The path to the PEM file containing the node’s private key and certificate chain.

    • PRIVATE_KEY_PASSWORD: The password for the private key. Omit private_key_password if the private key is not encrypted.

    • TRUSTED_CERTIFICATES_PATH: The path to the PEM file containing the trusted CA certificates.

  4. Restart HCD.

Was this helpful?

Give Feedback

How can we improve the documentation?

© Copyright IBM Corporation 2026 | Privacy policy | Terms of use |  Manage Privacy Choices

Apache, Apache Cassandra, Cassandra, Apache Tomcat, Tomcat, Apache Lucene, Apache Solr, Apache Hadoop, Hadoop, Apache Pulsar, Pulsar, Apache Spark, Spark, Apache TinkerPop, TinkerPop, Apache Kafka and Kafka are either registered trademarks or trademarks of the Apache Software Foundation or its subsidiaries in Canada, the United States and/or other countries. Kubernetes is the registered trademark of the Linux Foundation.

General Inquiries: Contact IBM