Chapter 6. Encrypting cluster transport

Procedure

1. Create a TLS keystore that contains a single certificate to identify Data Grid Server.

   You can also use a PEM file if it contains a private key in PKCS#1 or PKCS#8 format, a certificate, and has an empty password: password="".

   Note

   If the certificate in the keystore is not signed by a public certificate authority (CA) then you must also create a trust store that contains either the signing certificate or the public key.

2. Add the keystore to the $RHDG_HOME/server/conf directory.

3. Add the keystore to a new security realm in your Data Grid Server configuration.

   Important

   You should create dedicated keystores and security realms so that Data Grid Server endpoints do not use the same security realm as cluster transport.

   <server xmlns="urn:infinispan:server:13.0">
     <security>
       <security-realms>
         <security-realm name="cluster-transport">
           <server-identities>
             <ssl>
               <!-- Adds a keystore that contains a certificate that provides SSL/TLS identity to encrypt cluster transport. -->
               <keystore path="server.pfx"
                         relative-to="infinispan.server.config.path"
                         password="secret"
                         alias="server"/>
             </ssl>
           </server-identities>
         </security-realm>
       </security-realms>
     </security>
   </server>

4. Configure cluster transport to use the security realm by specifying the name of the security realm with the server:security-realm attribute.

   <infinispan>
     <cache-container>
       <transport server:security-realm="cluster-transport"/>
     </cache-container>
   </infinispan>

1. The first node in the Data Grid cluster, the coordinator node, generates a secret key.
2. A joining node performs certificate authentication with the coordinator to mutually verify identity.
3. The joining node requests the secret key from the coordinator node. That request includes the public key for the joining node.
4. The coordinator node encrypts the secret key with the public key and returns it to the joining node.
5. The joining node decrypts and installs the secret key.
6. The node joins the cluster, encrypting and decrypting messages with the secret key.

1. Nodes install the secret key from a keystore on the Data Grid classpath at startup.
2. Node join clusters, encrypting and decrypting messages with the secret key.

Procedure

1. Create a keystore with certificate chains that enables Data Grid to verify node identity.

2. Place the keystore on the classpath for each node in the cluster.

   For Data Grid Server, you put the keystore in the $RHDG_HOME directory.

3. Add the SSL_KEY_EXCHANGE and ASYM_ENCRYPT protocols to a JGroups stack in your Data Grid configuration, as in the following example:

   <infinispan>
     <jgroups>
       <!-- Creates a secure JGroups stack named "encrypt-tcp" that extends the default TCP stack. -->
       <stack name="encrypt-tcp" extends="tcp">
         <!-- Adds a keystore that nodes use to perform certificate authentication. -->
         <!-- Uses the stack.combine and stack.position attributes to insert SSL_KEY_EXCHANGE into the default TCP stack after VERIFY_SUSPECT. -->
         <SSL_KEY_EXCHANGE keystore_name="mykeystore.jks"
                           keystore_password="changeit"
                           stack.combine="INSERT_AFTER"
                           stack.position="VERIFY_SUSPECT"/>
         <!-- Configures ASYM_ENCRYPT -->
         <!-- Uses the stack.combine and stack.position attributes to insert ASYM_ENCRYPT into the default TCP stack before pbcast.NAKACK2. -->
         <!-- The use_external_key_exchange = "true" attribute configures nodes to use the `SSL_KEY_EXCHANGE` protocol for certificate authentication. -->
         <ASYM_ENCRYPT asym_keylength="2048"
                       asym_algorithm="RSA"
                       change_key_on_coord_leave = "false"
                       change_key_on_leave = "false"
                       use_external_key_exchange = "true"
                       stack.combine="INSERT_BEFORE"
                       stack.position="pbcast.NAKACK2"/>
       </stack>
     </jgroups>
     <cache-container name="default" statistics="true">
       <!-- Configures the cluster to use the JGroups stack. -->
       <transport cluster="${infinispan.cluster.name}"
                  stack="encrypt-tcp"
                  node-name="${infinispan.node.name:}"/>
     </cache-container>
   </infinispan>

Procedure

1. Create a keystore that contains a secret key.

2. Place the keystore on the classpath for each node in the cluster.

   For Data Grid Server, you put the keystore in the $RHDG_HOME directory.

3. Add the SYM_ENCRYPT protocol to a JGroups stack in your Data Grid configuration.