Version: Graph 1.x.x

TLS Setup for Graph

Aerospike Graph supports Transport Layer Security (TLS) for encrypting network traffic between Graph and the underlying Aerospike Database server.

Procedure

Set up TLS on your Aerospike Database server

Refer to the server documentation for help with setting up TLS on Aerospike.

Once all your certificates are in place, edit your Aerospike configuration file (located at /etc/aerospike/aerospike.conf by default). The following sample network context shows the required parameters for enabling TLS. Be sure to replace the placeholder <HOSTNAME> with the signed hostname of the SSL certificate.

network {
    tls <HOSTNAME> {
      cert-file /opt/aerospike/etc/aerospike_server.crt
      key-file /opt/aerospike/etc/aerospike_server.key
      ca-file /opt/aerospike/etc/ca.crt
      protocols TLSv1.2
    }
    service {
        address any
        access-address 172.17.0.1
        alternate-access-address 127.0.0.1
        access-port 3000
        port 3000
        tls-address any
        tls-port 4303
        tls-authenticate-client false
        tls-name <HOSTNAME>

        # Uncomment the following to set the `access-address` parameter to the
        # IP address of the Docker host. This will the allow the server to correctly
        # publish the address which applications and other nodes in the cluster to
        # use when addressing this node.
        # access-address <IPADDR>
    }
}

info

The tls-name parameter must be the cluster name (CN) that the certificate on the Aerospike server is signed for, and Graph must be able to resolve it as a DNS hostname. The DNS hostname must resolve to the IP address of the Aerospike server.

Set up certificates for your Graph instances
Your Graph SSL certificates require:
- A Certificate Authority (CA)
- Two signed certificate/key pairs (one for the Aerospike server and one for each of your Graph instances)
Put the CA and a certificate/key pair in a Java KeyStore and the CA in a Java TrustStore. Both files should use the extension .jks.
Configure Graph for TLS
If you use a configuration file to start your graph server, edit the file to include the parameter tls=true. Otherwise, use the command-line argument -e TLS=true when starting the Graph Docker image.
Set up the JAVA_OPTIONS environment variable
The JAVA_OPTIONS environment variable holds the path and password information for your KeyStore and TrustStore. The path information should be the paths to the files within the Docker container where you run the Graph Docker image. The following example shows usage:
```
JAVA_OPTIONS=-Djavax.net.ssl.trustStore=/path/to/trust-store.jks -Djavax.net.ssl.keyStore=/path/to/key-store.jks -Djavax.net.ssl.trustStorePassword=abc123 -Djavax.net.ssl.keyStorePassword=abc123
```
Start the Graph Docker image
Include the JAVA_OPTIONS environment variable when starting the Graph Docker image.
```
-e JAVA_OPTIONS
```

Procedure​

Procedure