Uploaded image for project: 'Red Hat Data Grid'
  1. Red Hat Data Grid
  2. JDG-4924

Server Guide: TLS transport

XMLWordPrintable

    • Icon: Task Task
    • Resolution: Done
    • Icon: Major Major
    • RHDG 8.3 GA
    • None
    • Documentation
    • None

      Improve docs for TLS transport.

      This configuration:

      <security-realm name="default">
               <server-identities>
                  <ssl>
                     <keystore path="server.p12"
                               relative-to="infinispan.server.config.path"
                               keystore-password="secret"
                               alias="server"/>
                     <truststore path="trust.p12"
                                 relative-to="infinispan.server.config.path"
                                 password="secret"/>
                  </ssl>
               </server-identities>
               <truststore-realm/>
            </security-realm>
      

      And this configuration:

      <cache-container>
            <transport server:security-realm="default"/>
         </cache-container>
      

      This combo means that cluster transport uses the keystore and truststore in SSL identities for security. Although in this configuration, it's the same stores as for endpoints so it's better to have two security realms.

      cluster transport that uses TLS also applies to RELAY messages and secures cross-site replication

      all sites must have the keystores and truststores to participate in key exchange. the keystore must contain a single certificate. can be the same on all sites or different. the truststore can contain certificates or the CA certificate only.

      note that TLS transport is an alternative to JGroups encryption mechanisms.

            dnaro@redhat.com Donald Naro
            dnaro@redhat.com Donald Naro
            Fabrizio Asta Fabrizio Asta
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: