Versions Compared

Old Version 18

changes.mady.by.user xiaojunjie

Saved on

compared with

New Version 19

changes.mady.by.user xiaojunjie

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. Generate an SSL Certificate

    In developmet environment, SSL certificates can be generated by openssl as follow:

    openssl genrsa -out private.key 1024

    openssl req -new -x509 -days 3650 -key private.key -out cert.crt -subj "/CN=my.host.name"

    In production environment, SSL certificates need to be purchased from the CA.

  2. Configure path of SSL Certificate in be.conf

    sslenable_enable https = true; 
    ssl_certificate_path = DORIS_HOME_DIR + "/conf/ssl/cert.crt";
    ssl_private_key_path = DORIS_HOME_DIR + "/conf/ssl/private.key";


  3. Enable SSL in brpc server

    brpc::ServerOptions options;
    baidu::rpc::CertInfo cert;
    cert.certificate =  Config.
    if (config::enable_https) {
        auto sslOptions = options.mutable_ssl_options();
        sslOptions->default_cert.certificate = config::ssl_certificate_path;
        sslOptions->default_cert.private_key
    = Config.
     = config::ssl_private_key_path;
    options.ssl_options.default_cert = cert; 
    }
    _server->Start(port, &options);


  4. Redirect http request to HTTPS

    In the brpc server, SSL-only mode can only be implemented using Controller::is_ssl() in service's callback.

    if (config::ssl_only && !cntl->is_ssl())  {
        cntl->http_response().set_status_code(baidu::rpc::HTTP_STATUS_FOUND);
        cntl->http_response().SetHeader("Location", "https://xxx");
    }

    The global configure for SSL-only mode of brpc would be supported in the future.

...