12.8. Encrypting cluster transport

Procedure

1. Create a TLS keystore that contains a single certificate to identify Data Grid Server.

   You can also use a PEM file if it contains a private key in PKCS#1 or PKCS#8 format, a certificate, and has an empty password: password="".

   注記

   If the certificate in the keystore is not signed by a public certificate authority (CA) then you must also create a trust store that contains either the signing certificate or the public key.

2. Add the keystore to the $RHDG_HOME/server/conf directory.

3. Add the keystore to a new security realm in your Data Grid Server configuration.

   重要

   You should create dedicated keystores and security realms so that Data Grid Server endpoints do not use the same security realm as cluster transport.

   <server xmlns="urn:infinispan:server:16.0">
     <security>
       <security-realms>
         <security-realm name="cluster-transport">
           <server-identities>
             <ssl>
               <!-- Adds a keystore that contains a certificate that provides SSL/TLS identity to encrypt cluster transport. -->
               <keystore path="server.pfx"
                         relative-to="infinispan.server.config.path"
                         password="secret"
                         alias="server"/>
             </ssl>
           </server-identities>
         </security-realm>
       </security-realms>
     </security>
   </server>

4. Configure cluster transport to use the security realm by specifying the name of the security realm with the server:security-realm attribute.

   <infinispan>
     <cache-container>
       <transport server:security-realm="cluster-transport"/>
     </cache-container>
   </infinispan>