-
Task
-
Resolution: Done
-
Major
-
None
-
None
-
False
-
False
-
Documentation (Ref Guide, User Guide, etc.), User Experience
-
Improve docs for TLS transport.
This configuration:
<security-realm name="default"> <server-identities> <ssl> <keystore path="server.p12" relative-to="infinispan.server.config.path" keystore-password="secret" alias="server"/> <truststore path="trust.p12" relative-to="infinispan.server.config.path" password="secret"/> </ssl> </server-identities> <truststore-realm/> </security-realm>
And this configuration:
<cache-container> <transport server:security-realm="default"/> </cache-container>
This combo means that cluster transport uses the keystore and truststore in SSL identities for security. Although in this configuration, it's the same stores as for endpoints so it's better to have two security realms.
cluster transport that uses TLS also applies to RELAY messages and secures cross-site replication
all sites must have the keystores and truststores to participate in key exchange. the keystore must contain a single certificate. can be the same on all sites or different. the truststore can contain certificates or the CA certificate only.
note that TLS transport is an alternative to JGroups encryption mechanisms.
- incorporates
-
ISPN-13460 Docs revision: Server TLS transport
- Closed
- is cloned by
-
JDG-4976 Server Guide: Multiple endpoints and config updates
- Closed