Enable client-to-server encryption

YugabyteDB clusters can be configured to use client-to-server encryption to protect data in transit between YugabyteDB servers and clients, tools, and APIs. When enabled, Transport Layer Security (TLS), the successor to the deprecated Secure Sockets Layer (SSL), is used to ensure data protection for YSQL and YCQL only. Note that there is no planned support for YEDIS.

Prerequisites

Before you can enable client-to-server encryption, you first must enable server-to-server encryption.

Configure YB-TServer nodes

To enable client-to-server encryption for YSQL and YCQL, start your YB-TServer services with the required flags described below. Your YB-Master services do not require additional configuration.

Configuration flag	Process	Description
--use_client_to_server_encryption	YB-TServer	Set to true to enable encryption between the various YugabyteDB clients and the database cluster. Default value is false.
--allow_insecure_connections	YB-TServer	Set to false to disallow any client with unencrypted communication from joining this cluster. Default value is true. Note that this flag requires --use_client_to_server_encryption to be enabled.
--certs_for_client_dir	YB-TServer	Optional. Defaults to the same directory as the server-to-server encryption. This directory should contain the configuration for the client to perform TLS communication with the cluster. Default value for YB-TServer is <data drive>/yb-data/tserver/data/certs

To enable access control, follow these steps, start the yb-tserver services with the following flag (described above):

--use_client_to_server_encryption=true

This flag enables both encrypted and unencrypted clients to connect to the cluster.

To prevent clients without the appropriate encryption from connecting, you must add the following flag:

--allow_insecure_connections=false

Your command should look similar to this:

bin/yb-tserver                                       \
    --fs_data_dirs=<data directories>                \
    --tserver_master_addrs=<master addresses>        \
    --certs_for_client_dir /home/centos/tls/$NODE_IP \
    --allow_insecure_connections=false               \
    --use_client_to_server_encryption=true &

For details about starting YB-TServer nodes in manual deployments, see Start YB-TServers.