---
title: "TLS between AGS and Aerospike DB"
description: "How to configure TLS encryption for network traffic between Aerospike Graph Service (AGS) and Aerospike DB."
---

# TLS between AGS and Aerospike DB

> For the complete documentation index see: [llms.txt](https://aerospike.com/docs/llms.txt)
> 
> All documentation pages available in markdown.

## Overview

This page describes how to set up Transport Layer Security (TLS) for encrypting network traffic between Aerospike Graph Service (AGS) and an Aerospike database instance.

### Prerequisites

-   Aerospike Database TLS setup:
    -   Configure [TLS on your Aerospike database cluster](https://aerospike.com/docs/database/learn/security/tls/#typical-authentication-setup).
    -   Record the `tls-name` configured during this step for later use.
-   TLS certificate files:
    -   Verify that the required TLS certificate file (**PEM-encoded X.509 format**) is in the local filesystem.

::: note
Wildcard hostname matching is not supported.  
Mutual authentication is not supported.
:::

### Procedure

1.  Configure AGS.
    
    In your [AGS properties file](https://aerospike.com/docs/graph/deploy/docker/#use-a-properties-file), set the following configuration options:
    
    ```txt
    aerospike.client.tls=true
    
    aerospike.client.host=<host>:<tls-name>:<port>
    
    # Replace <host> and <port> with your Aerospike DB host name and port.
    
    # Replace <tls-name> with the "tls-name" value from your Aerospike Database TLS configuration setup
    
    # in which you set up TLS on the Aerospike DB instance.
    ```
    
2.  Prepare TLS certificates directory.
    
    Create a local directory for storing your TLS certificate files, for example, `/home/graph-user/graph/tls`.
    
    ::: note
    The certificate directory must contain only valid TLS certificate files, like `.crt` or `.pem`. Do not include `.key` files or any other non-certificate files — these will cause AGS to return an error during startup.
    :::
    
3.  Run the Docker image.
    
    The [AGS Docker image](https://aerospike.com/docs/graph/deploy/docker) must have access to the TLS certificates. When starting the Docker image, use the `-v` flag to create a volume bind which binds a local directory containing the TLS files to the Docker image directory `/opt/aerospike-graph/aerospike-client-tls`.
    
    In the following example, the directory `/home/graph-user/graph/tls` contains the required certificate files.
    
    ```txt
    docker run -p 8182:8182 \
    
    -v /home/graph-user/graph/conf/aerospike-graph.properties:/opt/aerospike-graph/aerospike-graph.properties \
    
    -v /home/graph-user/graph/tls:/opt/aerospike-graph/aerospike-client-tls \
    
    aerospike/aerospike-graph-service
    ```
    
    If AGS encounters any problems with the TLS setup, the image startup fails with an error. If the image starts up without errors, the TLS connection is successful.