TLS setup for Aerospike Graph Service
Overview
This page describes how to set up Transport Layer Security (TLS) for for encrypting network traffic between Aerospike Graph Service (AGS) and the Aerospike Database (ASDB).
Prerequisite
- A running instance of an Aerospike database
- A Certificate Authority (CA)
- Two signed certificate/key pairs (one for the Aerospike database and one for each of your AGS instances)
Enable TLS
Enable TLS on your Aerospike database See TLS Configuration in the ASDB documentation to set up TLS on the Aerospike database.
Edit your Aerospike configuration file When all your certificates are in place, edit
aerospike.conf
(located at/etc/aerospike/aerospike.conf
by default). Replace the placeholderHOSTNAME
with the signed hostname of the SSL certificate.The following sample
network
context shows the required parameters for enabling TLS.network {
tls HOSTNAME {
cert-file /opt/aerospike/etc/aerospike_server.crt
key-file /opt/aerospike/etc/aerospike_server.key
ca-file /opt/aerospike/etc/ca.crt
protocols TLSv1.2
}
service {
address any
access-address 172.17.0.1
alternate-access-address 127.0.0.1
access-port 3000
port 3000
tls-address any
tls-port 4303
tls-authenticate-client false
tls-name HOSTNAME
# Uncomment the following to set the `access-address` parameter to the
# IP address of the Docker host. This will the allow the server to correctly
# publish the address which applications and other nodes in the cluster to
# use when addressing this node.
# access-address IPADDR
}
}infoThe
tls-name
parameter must be the cluster name (CN) that the certificate on the Aerospike database is signed for, and AGS must be able to resolve it as a DNS hostname. The DNS hostname must resolve to the IP address of the Aerospike database.Set up certificates for your AGS instances
Put the CA and a certificate/key pair in a Java KeyStore, and the CA in a Java TrustStore. Both files must use the extension
.jks
.Enable TLS for AGS
If you use a properties file to start your graph server, add the parameter
tls=true
to the file.You can also use the command-line argument
-e TLS=true
when starting the Graph Docker image.Set up the JAVA_OPTIONS environment variable
The JAVA_OPTIONS environment variable holds the path and password information for your KeyStore and TrustStore. This information are the paths to the files within the Docker container where you run the Graph Docker image. The following example shows usage:
JAVA_OPTIONS=-Djavax.net.ssl.trustStore=/path/to/trust-store.jks -Djavax.net.ssl.keyStore=/path/to/key-store.jks -Djavax.net.ssl.trustStorePassword=abc123 -Djavax.net.ssl.keyStorePassword=abc123
Start the Graph Docker image
Include the JAVA_OPTIONS environment variable when starting the Graph Docker image.
-e JAVA_OPTIONS