tls

The tls section configures TLS parameters for network data encryption in YDB.

Interconnect

Actor system interconnect of YDB is a specialized protocol for data exchange between YDB nodes.

Example of enabling TLS for the interconnect:

interconnect_config:
   start_tcp: true
   encryption_mode: REQUIRED # or OPTIONAL
   path_to_certificate_file: "/opt/ydb/certs/node.crt"
   path_to_private_key_file: "/opt/ydb/certs/node.key"
   path_to_ca_file: "/opt/ydb/certs/ca.crt"

YDB as a server

gRPC

The primary API of YDB is based on gRPC. It is used for external interaction with client applications that work directly with YDB via SDK or CLI.

Example of enabling TLS for the gRPC API:

grpc_config:
   cert: "/opt/ydb/certs/node.crt"
   key: "/opt/ydb/certs/node.key"
   ca: "/opt/ydb/certs/ca.crt"

Kafka protocol

YDB opens a separate network port for the Kafka protocol. This protocol is used for external interaction with client applications originally designed to work with Apache Kafka.

Example of enabling TLS for the Kafka protocol using a file that contains both a certificate and a private key:

kafka_proxy_config:
    ssl_certificate: "/opt/ydb/certs/node.crt"

Example of enabling TLS for the Kafka protocol with separate certificate and private key files:

kafka_proxy_config:
    cert: "/opt/ydb/certs/node.crt"
    key: "/opt/ydb/certs/node.key"

HTTP

YDB opens a separate HTTP port for the built-in interface, displaying metrics, and other auxiliary commands.

Example of enabling TLS on the HTTP port, which makes it use HTTPS:

monitoring_config:
    monitoring_certificate_file: "/opt/ydb/certs/node.crt"

For a detailed description of TLS parameters for monitoring, see the monitoring_config section.

YDB as a client

LDAP

YDB supports LDAP for user authentication. The LDAP protocol has two options for enabling TLS.

Example of enabling TLS for LDAP via the StartTls protocol extension:

auth_config:
  ldap_authentication:
    use_tls:
      enable: true
      ca_cert_file: "/path/to/ca.pem"
      cert_require: DEMAND
  scheme: "ldap"

Example of enabling TLS for LDAP via ldaps:

auth_config:
  ldap_authentication:
    use_tls:
      enable: false
      ca_cert_file: "/path/to/ca.pem"
      cert_require: DEMAND
  scheme: "ldaps"

For more details, this mechanism is described in {#T}.

Federated queries

Federated queries allow YDB to run queries against various external data sources. The use of TLS when running such queries is controlled by the USE_TLS parameter in CREATE EXTERNAL DATA SOURCE queries. No changes to the server configuration are required.

Tracing

YDB can send tracing data to an external collector via gRPC.

Example of enabling TLS for tracing data by specifying the grpcs:// protocol:

tracing_config:
  backend:
    opentelemetry:
      collector_url: grpcs://example.com:4317
      service_name: ydb

Asynchronous replication

Asynchronous replication synchronizes data between two YDB databases, one of which acts as a client to the other. The use of TLS in such communication is controlled by the CONNECTION_STRING parameter in CREATE ASYNC REPLICATION queries. For TLS connections, use the grpcs:// protocol. No changes to the server configuration are required.

When using a custom Certificate Authority (CA), pass its certificate in the CA_CERT parameter when creating an asynchronous replication instance.