apache/rocketmq
Watch
1
0
Fork
You've already forked rocketmq
 0
mirror of https://github.com/apache/rocketmq.git synced 2026-11-07 14:07:35 +00:00
Code Issues Projects Releases Packages Wiki Activity
Page: How to Configure TLS
Pages
FAQ Home How to Configure TLS RIP 1 MQTT Bridge RIP 10 RocketMQ Unit Test RIP 11 Evolution of The Next Decade Architecture for RocketMQ RIP 12 Message Connector RIP 13 RocketMQ Console Project RIP 14 RocketMQ Community Operation Conventions RIP 15 RocketMQ IPv6 Support Project RIP 16 RocketMQ RPC(Request Response model) Support RIP 17 RocketMQ HTTP Proxy Support RIP 18 Metadata Management Architecture Upgrade RIP 2 RocketMQ Spring RIP 20 Streaming Tiered Storage Optimize RIP 21 logical queue abstraction for static topic and fast scale out RIP 26 Improve Batch Message Processing Throughput RIP 27 Auto batching in producer RIP 28 Light message queue (LMQ) RIP 29 Optimize RocketMQ NameServer RIP 3 RocketMQ Python Client RIP 30 Support Compaction topic RIP 31 Support RocketMQ BrokerContainer RIP 32 Slave Acting Master Mode RIP 33 RocketMQ MQTT RIP 34 Support quorum write and adaptive degradation in master slave architecture RIP 4 RocketMQ Go Client RIP 41 RocketMQ E2E Test RIP 42 Support Schema Registry RIP 44 Support DLedger Controller RIP 45 RocketMQ Replicator 2.0 RIP 45 Support Graceful Shutdown RIP 46 Observability Improvement for RocketMQ RIP 47 Data Layout V2 RIP 48 Enhance server side offset management ability RIP 49 RocketMQ remoting module improvement RIP 5 RocketMQ ACL RIP 50 RocketMQ Transaction Message Improvement RIP 51 Pop orderly improvement RIP 52 Optimize Building ConsumeQueue RIP 54 Backporting of Remoting based Client RIP 55 Support remoting protocol in rocketmq proxy module RIP 56 Replace Logging Module with Shaded Logback RIP 57 Tiered storage for RocketMQ RIP 6 Message Trace RIP 63 Queue selection strategy optimization RIP 65 Tiered Storage Optimization RIP 66 Support KV(Rocksdb) Storage RIP 7 Multiple Directories Storage Support RIP 8 Consumer RACK Support RIP 9 RocketMQ Developer Guide RIP‐67 jRaft‐Controller Implemention RIP‐80 Priority Message RIP‐82 Implement Timer message, transaction message, and index based on RocksDB RIP‐82 Implement Timer transaction message and index based on RocksDB RIP‐83 Lite Topic: A New Message Model Release and Lifetime Support Policy RocketMQ Improvement Proposal SoC [RIP 19] Server side rebalance, lightweight consumer client support [RIP 58] RocketMQ Streams improvement [RIP‐70] Optimizing Lock Mechanisms [RIP‐73] Pop Consumption Improvement Based on RocksDB [RIP‐74] Flink‐Connector‐RocketMQ Dynamic Load Balancing [RIP‐77] Deprecate and Remove ACL 1.0
2 How to Configure TLS
Zhanhui Li edited this page 2022-10-10 10:47:17 +08:00
Table of contents

How to Configure TLS

Prerequisite

TLS itself is a complex mechanism, involving several security issues including Certificate Issuing of CA, Handshaking, Choosing of encryption algorithm, etc. It is strongly advised to read TLS Wikipedia Page and JCA.

Though you do not have to be a security expert before getting started, it's advisable to familiarize yourself with the following Handshake diagram, quoted from Wikipedia. TLS Handshake

RocketMQ Security Policy

RocketMQ uses Java options to manage and configure TLS. Through selectively combining these options and choices, RocketMQ servers(including name server and broker) can provide plaintext transport, single-side certificate verification TLS and mTLS.

tls.server.mode

Valid choices of this Java Option are disabled, permissive and enforcing.

If -Dtls.server.mode=disabled is set, servers will only accept and server plaintext transports. Namely, no TLS is available.

If -Dtls.server.mode=permissive is set, servers will accept both plaintext and TLS traffics at the same time.

If -Dtls.server.mode=enforcing is set, servers will accept TLS traffics only. Plaintext connections will be rejected since they would fail required handshake steps.

Examples

Development Environment with Self Signed Certificate

Simple Production Example

Production Example with Certificate Rotation

Copyright © 2016~2022 The Apache Software Foundation.