How to set up Cassandra client-to-node encryption with the DataStax Java driver?

Question

I've set up node-to-node encryption on my Cassandra cluster. Now I want to set up client-to-node. According to this documentation, it should be as easy as taking the SSL certificate of my client and importing it into every node's truststore. I don't have such a certificate yet but this is not my question.

Since my client is using the DataStax Java driver, it seems that in order to enable SSL from the client side, when I am building the Cluster I should use the withSSL() method to enable SSL. Okay, but what else do I need to do? I am not familiar with JSSE so I don't know what else is necessary. Is the SSL communication two-way, i.e. does the driver need to have access to the SSL certificates of each node in the cluster?

Ronrona

Answer 1

1. Create the certificates [1].

2. Enable client-node encryption in cassandra.yaml settings [2].

3. Add SSL support to your client. There is an excellent datastax blog on with sample code for setting up the SSL connection in your client [3].

4. A cert for your client. From what I can tell, it seems like you should be able to use the same keystore and trusture from [1] for the java client to use. Per [4], I know you need a pcks12 style PEM file to use cqlsh.

Also, [4] provides a barebones example of a client connecting to a cassandra cluster over SSL. [5] is an okay read for examples of cert creation for the cluster nodes and client.

5. [6] is the best example I've found of creating the certificates.

N.B. If you wish to use enterprise strength encryption, you'll need to enable the Java Cryptography Extension. For legal reasons, only relatively weak encryption is supported by the java that is shipped. Cassandra and your client will likely complain if you try to use 256 bit encryption without the JCE enabled. Do this for both the client and server machines:

1. Download http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html
2. Unzip the package

3. Copy the two policy jars into your JAVA_HOME, overwriting the two jars that are already there:

   [user@host UnlimitedJCEPolicy]$ ls local_policy.jar README.txt US_export_policy.jar [user@host UnlimitedJCEPolicy]$ export JAVA_HOME="$( readlink -f "$( which java )" | sed "s:bin/.*$::" )" [use@host UnlimitedJCEPolicy]$ echo $JAVA_HOME /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.65.x86_64/jre/ [user@host UnlimitedJCEPolicy]$ cp -v *.jar $JAVA_HOME/lib/security/

4. Restart cassandra and the client

[1] http://www.datastax.com/documentation/cassandra/2.0/cassandra/security/secureSSLCertificates_t.html

[2] http://www.datastax.com/documentation/cassandra/2.0/cassandra/security/secureSSLClientToNode_t.html

[3] http://www.datastax.com/dev/blog/accessing-secure-dse-clusters-with-cql-native-protocol

[4] https://github.com/PatrickCallaghan/datastax-ssl-example

[5] http://www.datastax.com/dev/blog/accessing-secure-dse-clusters-with-cql-native-protocol

[6] http://techdocs.acunu.com.s3.amazonaws.com/v5.0/admin/security/ssl.html

Cohen

I've done #1 and I've located the settings in #2 so I know what to do there. With regard to #3: I assume this means that my client application must have its own keystore and truststore? Must these be different files similar to how I set up the Cassandra nodes via the instructions in #1? – Ronrona

I don't think so. From what I can tell, you should be able to reuse one of the node's key/trust stores, since they all have to trust each other anyway. Also, I haven't seen any examples that included generating a client certificate except [5] above, which is a little ambiguous. – Cohen

I don't think I would want to reuse the nodes' stores. Since I'm supposed to make each node trust all of the others, spinning up a new node would mean I'd have to update the client's truststore. Or is this necessary? I had asked earlier if the SSL authentication was two-way. – Ronrona

In other words, I'm asking if my client application has to keep a truststore. If I have to update the client application's truststore every time I want to add a node I am not going to be able to use SSL, it's too prohibitive to release a new version of my application every time I want to reconfigure Cassandra. – Ronrona

I ended up following [6] for cert creation. The way they have certs set up, you can scale out both servers and clients without updating either trust store. – Cohen

The link for #6 is broken now. – Ronrona