Server TLS Encryption configuration

Cassandra Server TLS Encryption configuration

By default, the Server TLS Encryption is disabled.

Server TLS Encryption Field Specification Reference

Field	Description	Is Required	Default
encryption.server	Server TLS Encryption configuration.	N
encryption.server.internodeEncryption	Server encryption type. Allowed values: all, dc, rack, none. To encrypt all inter-node communications use all. To encrypt the traffic between the datacenters use dc.	N	none
encryption.server.requireEndpointVerification	Enables or disables host name verification.	N	false
encryption.server.requireClientAuth	Enables or disables Two-Way TLS authentication. If enabled the C* node verifies the certificate used by the other C* nodes which connects to it. The certificate used by C* node should be signed by a CA that the other C* node trusts.	N	true
encryption.server.caTLSSecret	CA TLS Secret fields configuration.	N	``
encryption.server.caTLSSecret.name	CA TLS Secret name which stores TLS CA data.	N	``
encryption.server.caTLSSecret.fileKey	CA TLS Secret fields which holds TLS CA key file.	N	ca.key
encryption.server.caTLSSecret.crtFileKey	CA TLS Secret fields which holds TLS CA certificate file.	N	ca.crt
encryption.server.nodeTLSSecret	Node TLS Secret name which stores TLS Node data.	N	``
encryption.server.nodeTLSSecret.name	Name of Node TLS Secret.	N	``
encryption.server.nodeTLSSecret.KeystoreFileKey	Node TLS Secret field which holds Keystore file. Keystore should contain keypair chains.	N	keystore.jks
encryption.server.nodeTLSSecret.KeystorePasswordKey	Node TLS Secret field which holds password file for Keystore. The password must match that one is used when generating the Keystore.	N	cassandra
encryption.server.nodeTLSSecret.TruststoreFileKey	Node TLS Secret field which holds Truststore file. Truststore should contain chain of trusted CA certificates.	N	truststore.jks
encryption.server.nodeTLSSecret.TruststorePasswordKey	Node TLS Secret field which holds password file for Truststore. The password must match that one is used when generating the Truststore.	N	cassandra
encryption.server.nodeTLSSecret.generateKeystorePassword	Node TLS Secret field which holds password to encrypt keystore and truststore during generating. It's used only in case encryption.server.caTLSSecret.name is provided.	N	cassandra
encryption.server.nodeTLSSecret.caFileKey	Node TLS Secret field which holds ca certificate file.	N	ca.crt
encryption.server.nodeTLSSecret.tlsFileKey	Node TLS Secret field which holds TLS certificate file.	N	tls.crt
encryption.server.nodeTLSSecret.tlsCrtFileKey	Node TLS Secret field which holds TLS key file.	N	tls.key
encryption.server.protocol	Cryptographic protocol.	N	TLS
encryption.server.algorithm	Key exchange or key agreement method.	N	SunX509
encryption.server.storeType	Archive format of Keystore.	N	JKS
encryption.server.cipherSuites	The list of cipher suites for the server to support, in order of preference.	N	``

Multi-cluster setup

In multi-cluster setup TLS Secret should be generated (signed) using the same CA.