Versions Compared

Old Version 22

changes.mady.by.user xiaojunjie

Saved on

compared with

New Version 23

changes.mady.by.user xiaojunjie

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. Generate an SSL Certificate

    In developmet environment, SSL certificates can be generated by openssl as follow:

    openssl genrsa -out private.key pem 1024

    openssl req -new -x509 -days 3650 -key private.key pem -out cert.crt pem -subj "/CN=my.host.name"

    In production environment, SSL certificates need to be purchased from the CA.

  2. Configure path of SSL Certificate in be.conf

    enable_https = true; 
    ssl_certificate_path = DORIS_HOME_DIR + "/conf/ssl/cert.crtpem";
    ssl_private_key_path = DORIS_HOME_DIR + "/conf/ssl/private.keypem";


  3. Turn on SSL in brpc server


    Fill the sslOption with the path of certificate and private key before starting server.

    if (config::enable_https) {
        auto sslOptions = options.mutable_ssl_options();
        sslOptions->default_cert.certificate = config::ssl_certificate_path;
        sslOptions->default_cert.private_key = config::ssl_private_key_path;
    }
    _server->Start(port, &options);


  4. Redirect http request to HTTPS

    In the brpc server, SSL-only mode can only be implemented using Controller::is_ssl() in callback of each service.

    if (config::ssl_only && !cntl->is_ssl())  {
        cntl->http_response().set_status_code(baidu::rpc::HTTP_STATUS_FOUND);
        cntl->http_response().SetHeader("Location", "https://xxx");
    }

    A global configure for SSL-only mode may be better than the implementation described above, which would be supported by brpc in the future.

...