Introduction
This document describes how to use SSL feature of ZooKeeper.
By default network communication of ZooKeeper isn’t encrypted. However, each user and service can leverage the SSL feature and/or custom authentication implementation in order to use ZooKeeper in secure mode.
Netty communication
ZooKeeper was initially designed and implemented using Java NIO package. Later on, we add Netty feature to optionally take place of NIO since Netty has better support for SSL. Thus, SSL is only supported on top of Netty communication, which means if you want to use SSL you have to enable the Netty feature. We will discuss how to do it in the following section.
SSL
It's added in ZOOKEEPER-2125.
Client-Server Communication
The communication between ZooKeeper client and server has Netty and SSL support. Note that Netty needs to be enabled to use SSL.
Client
ZooKeeper client can use Netty by setting property:
zookeeper.clientCnxnSocket="org.apache.zookeeper.ClientCnxnSocketNetty"
In order to do secure communication on client, set property:
zookeeper.client.secure=true
Note that with this property set the client could and should only connect to server’s “secureClientPort
” which will be described shortly.
Then set up keystore and truststore environment by setting the following properties:
zookeeper.ssl.keyStore.location="/path/to/your/keystore" zookeeper.ssl.keyStore.password="keystore_password" zookeeper.ssl.trustStore.location="/path/to/your/truststore" zookeeper.ssl.trustStore.password="truststore_password"
Server
ZooKeeper server can use Netty by setting property:
zookeeper.serverCnxnFactory="org.apache.zookeeper.server.NettyServerCnxnFactory"
ZooKeeper server also needs to provide a listening port to accept secure client connections. This port is different from and running in parallel with the known “clientPort”. It should be added in “zoo.cfg”:
... secureClientPort=2281
All secure clients (mentioned above) should connect to this port.
Then set up keystore and truststore environment like what client does.
Quorum
Not supported yet!
Authentication
It's added in ZOOKEEPER-2123.