Set up local encryption keys for production environments

To ensure support for all encryption algorithms, make sure the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy is enabled. In JDK 8u161 and later, this is enabled by default.

If the encryption key directory does not exist, create the /conf directory for your HCD installation type:

Generate the encryption key file:

echo -n "$(openssl rand -hex 32)" > /etc/hcd/conf/system_key

Ensure that the system user that runs HCD has read and write access on the file. If necessary, change the ownership of the file to the HCD user.

chown cassandra /etc/hcd/conf/system_key

Make sure the encryption key file is stored in the same location on all nodes in the cluster, and the HCD user has appropriate permissions on the file.

Update the system_key_directory property in the cassandra.yaml file.