Uploaded image for project: 'Red Hat Data Grid'
  1. Red Hat Data Grid
  2. JDG-4924

Server Guide: TLS transport

XMLWordPrintable

    • Icon: Task Task
    • Resolution: Done
    • Icon: Major Major
    • RHDG 8.3 GA
    • None
    • Documentation
    • None

      Improve docs for TLS transport.

      This configuration:

      <security-realm name="default">
               <server-identities>
                  <ssl>
                     <keystore path="server.p12"
                               relative-to="infinispan.server.config.path"
                               keystore-password="secret"
                               alias="server"/>
                     <truststore path="trust.p12"
                                 relative-to="infinispan.server.config.path"
                                 password="secret"/>
                  </ssl>
               </server-identities>
               <truststore-realm/>
            </security-realm>
      

      And this configuration:

      <cache-container>
            <transport server:security-realm="default"/>
         </cache-container>
      

      This combo means that cluster transport uses the keystore and truststore in SSL identities for security. Although in this configuration, it's the same stores as for endpoints so it's better to have two security realms.

      cluster transport that uses TLS also applies to RELAY messages and secures cross-site replication

      all sites must have the keystores and truststores to participate in key exchange. the keystore must contain a single certificate. can be the same on all sites or different. the truststore can contain certificates or the CA certificate only.

      note that TLS transport is an alternative to JGroups encryption mechanisms.

              dnaro@redhat.com Donald Naro
              dnaro@redhat.com Donald Naro
              Fabrizio Asta Fabrizio Asta
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: