---
metadata:
  - name: generator
    content: Diplodoc Platform v5.52.0
alternate:
  - https://ydb.tech/docs/en/security/encryption/data-in-transit.md?version=v25.3
  - https://ydb.tech/docs/ru/security/encryption/data-in-transit.md?version=v25.3
  - href: en/security/encryption/data-in-transit.md
    type: text/markdown
    title: Markdown version
  - href: ../../llms.txt
    type: text/markdown
    title: llms.txt
sourcePath: en/core/security/encryption/data-in-transit.md
---
> **Documentation Index:** Fetch the complete configuration index at https://ydb.tech/docs/en/llms.txt

# Data in transit encryption

As YDB is a distributed system typically running on a cluster, often spanning multiple datacenters or availability zones, user data is routinely transferred over the network. Various protocols can be involved, and each can be configured to run over [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security). Below is a list of protocols supported by YDB:

* [Interconnect](https://ydb.tech/docs/en/concepts/glossary.md?version=v25.3#actor-system-interconnect), a specialized protocol for all communication between YDB nodes.
* YDB as a server:

  * [gRPC](https://ydb.tech/docs/en/reference/ydb-sdk/overview-grpc-api.md?version=v25.3) for external communication with client applications designed to work natively with YDB via the [SDK](https://ydb.tech/docs/en/reference/ydb-sdk/index.md?version=v25.3) or [CLI](https://ydb.tech/docs/en/reference/ydb-cli/index.md?version=v25.3).
  * [Kafka wire protocol](https://ydb.tech/docs/en/reference/kafka-api/index.md?version=v25.3) for external communication with client applications initially designed to work with [Apache Kafka](https://kafka.apache.org/).
  * HTTP for running the [Embedded UI](https://ydb.tech/docs/en/reference/embedded-ui/index.md?version=v25.3), exposing [metrics](https://ydb.tech/docs/en/devops/observability/monitoring.md?version=v25.3), and other miscellaneous endpoints.

* YDB as a client:

  * [LDAP](https://ydb.tech/docs/en/security/authentication.md?version=v25.3#ldap) for user authentication.
  * [Federated queries](https://ydb.tech/docs/en/concepts/query_execution/federated_query/index.md?version=v25.3), a feature that allows YDB to query various external data sources. Some sources are queried directly from the `ydbd` process, while others are proxied via a separate connector process.
  * [Tracing](https://ydb.tech/docs/en/reference/observability/tracing/setup.md?version=v25.3) data sent to an external collector via gRPC.

* In [asynchronous replication](https://ydb.tech/docs/en/concepts/async-replication.md?version=v25.3) between two YDB databases, one serves as a client to the other.

By default, data in transit encryption is disabled and must be enabled separately for each protocol. They can either share the same set of TLS certificates or use dedicated ones. For instructions on how to enable TLS, refer to the [tls](https://ydb.tech/docs/en/reference/configuration/tls.md?version=v25.3) section.