<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="mysql-cluster-tls-using">
      </a>
      25.6.15.3 Using TLS Connections
     </h4>
    </div>
   </div>
  </div>
  <p>
   Once you have created a CA and certificate, you can test the
        availability of the TLS connection to the management server by
        running the
   <a class="link" href="mysql-cluster-programs-ndb-mgm.html" title="25.5.5 ndb_mgm — The NDB Cluster Management Client">
    <span class="command">
     <strong>
      ndb_mgm
     </strong>
    </span>
   </a>
   client with
   <a class="link" href="mysql-cluster-programs-ndb-mgm.html#option_ndb_mgm_test-tls">
    <code class="option">
     --test-tls
    </code>
   </a>
   , like this:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa38674455"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">ndb_mgm</span> <span class="token property">--test-tls</span>
No valid certificate<span class="token punctuation">.</span></code></pre>
  </div>
  <p>
   An appropriate message is generated if the client can connect
        using TLS. You may need to include other
   <a class="link" href="mysql-cluster-programs-ndb-mgm.html" title="25.5.5 ndb_mgm — The NDB Cluster Management Client">
    <span class="command">
     <strong>
      ndb_mgm
     </strong>
    </span>
   </a>
   options such as
   <a class="link" href="mysql-cluster-programs-ndb-mgm.html#option_ndb_mgm_ndb-tls-search-path">
    <code class="option">
     --ndb-tls-search-path
    </code>
   </a>
   to
        facilitate the TLS connection, as shown here:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa10894999"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">ndb_mgm</span> <span class="token property">--test-tls</span> <span class="token constant">--ndb-tls-search-path</span>=<span class="token atrule">"CA:keys"</span>
Connected to management server at localhost port 1186 <span class="token punctuation">(</span>using TLS<span class="token punctuation">)</span></code></pre>
  </div>
  <p>
   If the client connects without using TLS, this is also
        indicated, similarly to what is shown here:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa25752619"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">ndb_mgm</span>
Connected to management server at localhost port 1186 <span class="token punctuation">(</span>using cleartext<span class="token punctuation">)</span>
$&gt;</code></pre>
  </div>
  <p>
   You can cause the cluster to use the CA and certificates created
        with
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html" title="25.5.28 ndb_sign_keys — Create, Sign, and Manage TLS Keys and Certificates for NDB Cluster">
    <span class="command">
     <strong>
      ndb_sign_keys
     </strong>
    </span>
   </a>
   by performing a rolling
        restart of the cluster, beginning with the management nodes,
        which should be restarted using the
   <a class="link" href="mysql-cluster-programs-ndb-mgmd.html#option_ndb_mgmd_ndb-tls-search-path">
    <code class="option">
     --ndb-tls-search-path
    </code>
   </a>
   option.
        After this, restart the data nodes, again using
   <a class="link" href="mysql-cluster-programs-ndbd.html#option_ndbd_ndb-tls-search-path">
    <code class="option">
     --ndb-tls-search-path
    </code>
   </a>
   .
   <a class="link" href="mysql-cluster-options-variables.html#option_mysqld_ndb-tls-search-path">
    <code class="option">
     --ndb-tls-search-path
    </code>
   </a>
   is also
        supported for
   <a class="link" href="mysqld.html" title="6.3.1 mysqld — The MySQL Server">
    <span class="command">
     <strong>
      mysqld
     </strong>
    </span>
   </a>
   run as a cluster API
        node.
  </p>
  <p>
   For TLS to function, every node connecting to the cluster must
        have a valid certificate and key. This includes data nodes, API
        nodes, and utility programs. The same certificate and key files
        can be used by more than one node.
  </p>
  <p>
   Data nodes log the TLS connection and include the full path to
        the certificate file used, as shown here:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa82690806"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">ndbmtd</span> <span class="token property">-c</span> localhost<span class="token punctuation">:</span>1186 <span class="token constant">--ndb-tls-search-path</span>=<span class="token atrule">'CA:keys'</span>
2023-12-19 12<span class="token punctuation">:</span>02<span class="token punctuation">:</span>15 <span class="token punctuation">[</span>ndbd<span class="token punctuation">]</span> INFO     <span class="token property">--</span> NDB TLS 1<span class="token punctuation">.</span>3 available using certificate file <span class="token atrule">'keys/ndb-data-node-cert'</span>
2023-12-19 12<span class="token punctuation">:</span>02<span class="token punctuation">:</span>15 <span class="token punctuation">[</span>ndbd<span class="token punctuation">]</span> INFO     <span class="token property">--</span> Angel connected to <span class="token atrule">'localhost:1186'</span>
2023-12-19 12<span class="token punctuation">:</span>02<span class="token punctuation">:</span>15 <span class="token punctuation">[</span>ndbd<span class="token punctuation">]</span> INFO     <span class="token property">--</span> Angel allocated nodeid<span class="token punctuation">:</span> 5</code></pre>
  </div>
  <p>
   You can verify that cluster nodes are using TLS to connect by
        checking the output of the
   <a class="link" href="mysql-cluster-mgm-client-commands.html#ndbclient-tls-info">
    <code class="literal">
     TLS
        INFO
    </code>
   </a>
   command in the
   <a class="link" href="mysql-cluster-programs-ndb-mgm.html" title="25.5.5 ndb_mgm — The NDB Cluster Management Client">
    <span class="command">
     <strong>
      ndb_mgm
     </strong>
    </span>
   </a>
   client,
        like this:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa36754308"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">ndb_mgm</span> <span class="token constant">--ndb-tls-search-path</span>=<span class="token atrule">"CA:keys"</span>
<span class="token property">--</span> NDB Cluster <span class="token property">--</span> Management Client <span class="token property">--</span>
ndb_mgm&gt; TLS INFO
Connected to management server at localhost port 1186 <span class="token punctuation">(</span>using TLS<span class="token punctuation">)</span>
 
Main interactive connection is using TLS
Event listener connection is using TLS
 
Server reports 6 TLS connections<span class="token punctuation">.</span>

  Session ID<span class="token punctuation">:</span>          32
  Peer address<span class="token punctuation">:</span>        <span class="token punctuation">:</span><span class="token punctuation">:</span>
  Certificate name<span class="token punctuation">:</span>    NDB Node Dec 2023
  Certificate serial<span class="token punctuation">:</span>  39<span class="token punctuation">:</span>1E<span class="token punctuation">:</span>4A<span class="token punctuation">:</span>78<span class="token punctuation">:</span>E5<span class="token punctuation">:</span>93<span class="token punctuation">:</span>45<span class="token punctuation">:</span>09<span class="token punctuation">:</span>FC<span class="token punctuation">:</span>56
  Certificate expires<span class="token punctuation">:</span> 21-Apr-2024
 
  Session ID<span class="token punctuation">:</span>          31
  Peer address<span class="token punctuation">:</span>        127<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>1
  Certificate name<span class="token punctuation">:</span>    NDB Node Dec 2023
  Certificate serial<span class="token punctuation">:</span>  39<span class="token punctuation">:</span>1E<span class="token punctuation">:</span>4A<span class="token punctuation">:</span>78<span class="token punctuation">:</span>E5<span class="token punctuation">:</span>93<span class="token punctuation">:</span>45<span class="token punctuation">:</span>09<span class="token punctuation">:</span>FC<span class="token punctuation">:</span>56
  Certificate expires<span class="token punctuation">:</span> 21-Apr-2024
 
  Session ID<span class="token punctuation">:</span>          30
  Peer address<span class="token punctuation">:</span>        127<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>1
  Certificate name<span class="token punctuation">:</span>    NDB Node Dec 2023
  Certificate serial<span class="token punctuation">:</span>  39<span class="token punctuation">:</span>1E<span class="token punctuation">:</span>4A<span class="token punctuation">:</span>78<span class="token punctuation">:</span>E5<span class="token punctuation">:</span>93<span class="token punctuation">:</span>45<span class="token punctuation">:</span>09<span class="token punctuation">:</span>FC<span class="token punctuation">:</span>56
  Certificate expires<span class="token punctuation">:</span> 21-Apr-2024
 
  Session ID<span class="token punctuation">:</span>          18
  Peer address<span class="token punctuation">:</span>        127<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>1
  Certificate name<span class="token punctuation">:</span>    NDB Data Node Dec 2023
  Certificate serial<span class="token punctuation">:</span>  57<span class="token punctuation">:</span>5E<span class="token punctuation">:</span>58<span class="token punctuation">:</span>70<span class="token punctuation">:</span>7C<span class="token punctuation">:</span>49<span class="token punctuation">:</span>B3<span class="token punctuation">:</span>74<span class="token punctuation">:</span>1A<span class="token punctuation">:</span>99
  Certificate expires<span class="token punctuation">:</span> 07-May-2024
 
  Session ID<span class="token punctuation">:</span>          12
  Peer address<span class="token punctuation">:</span>        127<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>1
  Certificate name<span class="token punctuation">:</span>    NDB Data Node Dec 2023
  Certificate serial<span class="token punctuation">:</span>  57<span class="token punctuation">:</span>5E<span class="token punctuation">:</span>58<span class="token punctuation">:</span>70<span class="token punctuation">:</span>7C<span class="token punctuation">:</span>49<span class="token punctuation">:</span>B3<span class="token punctuation">:</span>74<span class="token punctuation">:</span>1A<span class="token punctuation">:</span>99
  Certificate expires<span class="token punctuation">:</span> 07-May-2024
 
  Session ID<span class="token punctuation">:</span>          1
  Peer address<span class="token punctuation">:</span>        127<span class="token punctuation">.</span>0<span class="token punctuation">.</span>0<span class="token punctuation">.</span>1
  Certificate name<span class="token punctuation">:</span>    NDB Management Node Dec 2023
  Certificate serial<span class="token punctuation">:</span>  32<span class="token punctuation">:</span>10<span class="token punctuation">:</span>44<span class="token punctuation">:</span>3C<span class="token punctuation">:</span>F4<span class="token punctuation">:</span>7D<span class="token punctuation">:</span>73<span class="token punctuation">:</span>40<span class="token punctuation">:</span>97<span class="token punctuation">:</span>41
  Certificate expires<span class="token punctuation">:</span> 17-May-2024
 
 
    Server statistics since restart
  Total accepted connections<span class="token punctuation">:</span>        32
  Total connections upgraded to TLS<span class="token punctuation">:</span> 8
  Current connections<span class="token punctuation">:</span>               6
  Current connections using TLS<span class="token punctuation">:</span>     6
  Authorization failures<span class="token punctuation">:</span>            0
ndb_mgm&gt;</code></pre>
  </div>
  <p>
   If
   <code class="literal">
    Current connections
   </code>
   and
   <code class="literal">
    Current
        connections using TLS
   </code>
   are the same, this means that
        all cluster connections are using TLS.
  </p>
  <p>
   Once you have established TLS connections for all nodes, you
        should make TLS a strict requirement. For clients, you can do
        this by setting
   <code class="option">
    ndb-mgm-tls=strict
   </code>
   in the
   <code class="filename">
    my.cnf
   </code>
   file on each cluster host. Enforce
        the TLS requirement on the management server by setting
   <a class="link" href="mysql-cluster-mgm-definition.html#ndbparam-mgmd-requiretls">
    <code class="literal">
     RequireTls=true
    </code>
   </a>
   in the
   <code class="literal">
    [mgm default]
   </code>
   section of the cluster
   <code class="filename">
    config.ini
   </code>
   file, then performing a rolling
        restart of the cluster so that this change takes effect. Do this
        for the data nodes as well, by setting
   <a class="link" href="mysql-cluster-ndbd-definition.html#ndbparam-ndbd-requiretls">
    <code class="literal">
     RequireTls=true
    </code>
   </a>
   in the
   <code class="literal">
    [ndbd default]
   </code>
   section of the configuration
        file; after this, perform a second rolling restart of the
        cluster to make the changes take effect on the data nodes. Start
   <a class="link" href="mysql-cluster-programs-ndb-mgmd.html" title="25.5.4 ndb_mgmd — The NDB Cluster Management Server Daemon">
    <span class="command">
     <strong>
      ndb_mgmd
     </strong>
    </span>
   </a>
   with the
   <a class="link" href="mysql-cluster-programs-ndb-mgmd.html#option_ndb_mgmd_reload">
    <code class="option">
     --reload
    </code>
   </a>
   and
   <a class="link" href="mysql-cluster-programs-ndb-mgmd.html#option_ndb_mgmd_config-file">
    <code class="option">
     --config-file
    </code>
   </a>
   options both
        times to ensure that each of the two configuration file changes
        is read by the management server.
  </p>
  <p>
   To replace a private key, use
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html" title="25.5.28 ndb_sign_keys — Create, Sign, and Manage TLS Keys and Certificates for NDB Cluster">
    <span class="command">
     <strong>
      ndb_sign_keys
     </strong>
    </span>
   </a>
   <code class="option">
    --create-key
   </code>
   to create the new key and
        certificate, with the
   <code class="option">
    --node-id
   </code>
   and
   <code class="option">
    --node-type options
   </code>
   if and as necessary to
        limit the replacement to a single node ID, node type, or both.
        If the tool finds existing key and certificate files, it renames
        them to reflect their retired status, and saves the newly
        created key and certificate as active files; the new files are
        used the next time that the node is restarted.
  </p>
  <p>
   To replace a certificate without replacing the private key, use
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html" title="25.5.28 ndb_sign_keys — Create, Sign, and Manage TLS Keys and Certificates for NDB Cluster">
    <span class="command">
     <strong>
      ndb_sign_keys
     </strong>
    </span>
   </a>
   without supplying the
   <code class="option">
    --create-key
   </code>
   option. This creates a new
        certificate for the existing key (without replacing the key),
        and retires the old certificate.
  </p>
  <p>
   Remote key siging is is also supported by ndb_sign_keys. Using
        SSH, the
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html#option_ndb_sign_keys_remote-CA-host">
    <code class="option">
     --remote-CA-host
    </code>
   </a>
   option supplies the SSH address of the CA host in
   <code class="literal">
    user@host
   </code>
   format. By default, the local
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html" title="25.5.28 ndb_sign_keys — Create, Sign, and Manage TLS Keys and Certificates for NDB Cluster">
    <span class="command">
     <strong>
      ndb_sign_keys
     </strong>
    </span>
   </a>
   process uses the system
   <span class="command">
    <strong>
     ssh
    </strong>
   </span>
   utility and address to run
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html" title="25.5.28 ndb_sign_keys — Create, Sign, and Manage TLS Keys and Certificates for NDB Cluster">
    <span class="command">
     <strong>
      ndb_sign_keys
     </strong>
    </span>
   </a>
   on the remote host with the
        correct options to perform the desired signing. Alternately, if
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html#option_ndb_sign_keys_remote-openssl">
    <code class="option">
     --remote-openssl=true
    </code>
   </a>
   ,
   <span class="command">
    <strong>
     openssl
    </strong>
   </span>
   rather than
   <a class="link" href="mysql-cluster-programs-ndb-sign-keys.html" title="25.5.28 ndb_sign_keys — Create, Sign, and Manage TLS Keys and Certificates for NDB Cluster">
    <span class="command">
     <strong>
      ndb_sign_keys
     </strong>
    </span>
   </a>
   is used on the remote host.
  </p>
  <p>
   When using remote signing, the data sent over the network is a
        PKCS#10 signing request, and not the private key, which never
        leaves the local host.
  </p>
 </div>
 <br/>
</div>
