{"action":"created","issue":{"url":"https://api.github.com/repos/crate/crate/issues/1794","labels_url":"https://api.github.com/repos/crate/crate/issues/1794/labels{/name}","comments_url":"https://api.github.com/repos/crate/crate/issues/1794/comments","events_url":"https://api.github.com/repos/crate/crate/issues/1794/events","html_url":"https://github.com/crate/crate/pull/1794","id":62390946,"number":1794,"title":"Add SSL/TLS transport security","user":{"login":"salyh","id":3762447,"avatar_url":"https://avatars.githubusercontent.com/u/3762447?v=3","gravatar_id":"","url":"https://api.github.com/users/salyh","html_url":"https://github.com/salyh","followers_url":"https://api.github.com/users/salyh/followers","following_url":"https://api.github.com/users/salyh/following{/other_user}","gists_url":"https://api.github.com/users/salyh/gists{/gist_id}","starred_url":"https://api.github.com/users/salyh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/salyh/subscriptions","organizations_url":"https://api.github.com/users/salyh/orgs","repos_url":"https://api.github.com/users/salyh/repos","events_url":"https://api.github.com/users/salyh/events{/privacy}","received_events_url":"https://api.github.com/users/salyh/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-03-17T13:07:25Z","updated_at":"2015-03-20T09:24:43Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/crate/crate/pulls/1794","html_url":"https://github.com/crate/crate/pull/1794","diff_url":"https://github.com/crate/crate/pull/1794.diff","patch_url":"https://github.com/crate/crate/pull/1794.patch"},"body":"This PR adds SSL/TLS transport layer security so that cluster communication as well as connections to the cluster via CrateClient are secured by TLS. \r\n\r\nSetup is done in crate.yml\r\n<pre>\r\n###################################### Security ####################################\r\n\r\n# Enable or disable transport layer security (default: false)\r\n#security.ssl.transport.node.enabled: true\r\n\r\n# Enable or disable SSL hostname verfification (default: true)\r\n#security.ssl.transport.node.hostname_verification.enabled: false\r\n\r\n# Enable or disable hostname resolving for hostname verfification (default: true)\r\n# This settings has no effect if hostname_verification is disabled\r\n#security.ssl.transport.node.hostname_verification.resolve_host_name: false\r\n\r\n# If true then the nodes have to trust each other, if false then only the client node has to trust the server node\r\n# (default: true)\r\n#security.ssl.transport.node.need_clientauth: false\r\n\r\n# Path to the keystore (default is value of javax.net.ssl.keyStore)\r\n# This setting is mandatory if javax.net.ssl.keyStore is not set\r\n#security.ssl.transport.node.keystore.path: null\r\n\r\n# Keystore password (default is value of javax.net.ssl.keyStorePassword or 'changeit' if not set)\r\n#security.ssl.transport.node.keystore.password: changeit\r\n\r\n# Keystore type (default is value of javax.net.ssl.keyStoreType or 'JKS' if not set)\r\n# JKS or PKCS12 are supported\r\n#security.ssl.transport.node.keystore.type: PKCS12\r\n\r\n# Path to the truststore (default is value of javax.net.ssl.trustStore)\r\n# This setting is mandatory if javax.net.ssl.trustStore is not set\r\n# Can be the same as security.ssl.transport.node.keystore.path\r\n#security.ssl.transport.node.truststore.path: null\r\n\r\n# Truststore password (default is value of javax.net.ssl.trustStorePassword or 'changeit' if not set)\r\n#security.ssl.transport.node.truststore.password: changeit\r\n\r\n# Truststore type (default is value of javax.net.ssl.trustStoreType or 'JKS' if not set)\r\n# JKS or PKCS12 are supported\r\n#security.ssl.transport.node.truststore.type: PKCS12\r\n\r\n# SSL context cache size (default: 1000)\r\n# A value of zero means unlimited (WARNING: this can cause memory leaks)\r\n#security.ssl.transport.node.session.cache_size: 1000\r\n\r\n# SSL context session timeout expressed in seconds (default: 86400, which means 24h)\r\n# A value of zero means unlimited (WARNING: this can cause memory leaks)\r\n#security.ssl.transport.node.session.timeout: 86400\r\n</pre>\r\n\r\nThan connect:\r\n<code>\r\nCrateClient client = new CrateClient(settings, true).addTransportAddress(new InetSocketTransportAddress(\"localhost\", 4300));\r\n</code>\r\n\r\nFor setting up the keystore and truststore together with a certificate authority (CA) look here:\r\n<code>\r\nsecurity/pki-scripts/example.sh\r\n</code>\r\nUsing a root CA make it possible to add new nodes to the cluster without a cluster restart.\r\n\r\nNote: Running tests with ./gradlew test itest fails because of a bogus gradle dependency error, in IDEA its working well. ./gradlew test itest fails anyhow on master too :-)"},"comment":{"url":"https://api.github.com/repos/crate/crate/issues/comments/83966563","html_url":"https://github.com/crate/crate/pull/1794#issuecomment-83966563","issue_url":"https://api.github.com/repos/crate/crate/issues/1794","id":83966563,"user":{"login":"salyh","id":3762447,"avatar_url":"https://avatars.githubusercontent.com/u/3762447?v=3","gravatar_id":"","url":"https://api.github.com/users/salyh","html_url":"https://github.com/salyh","followers_url":"https://api.github.com/users/salyh/followers","following_url":"https://api.github.com/users/salyh/following{/other_user}","gists_url":"https://api.github.com/users/salyh/gists{/gist_id}","starred_url":"https://api.github.com/users/salyh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/salyh/subscriptions","organizations_url":"https://api.github.com/users/salyh/orgs","repos_url":"https://api.github.com/users/salyh/repos","events_url":"https://api.github.com/users/salyh/events{/privacy}","received_events_url":"https://api.github.com/users/salyh/received_events","type":"User","site_admin":false},"created_at":"2015-03-20T09:24:43Z","updated_at":"2015-03-20T09:24:43Z","body":"oh, forgot: Commit 9ca57afafcf51915a2ebb5197da9926582be3db5 provides a fix for udc (NPE and TLS). So this is unrelated to the things discussed above (would be better if i had opened a separate PR for that, sorry)"}}