Other TLS Related configurations
In order to use a secured communication between the Hazelcast cluster and Management Center, you have to configure Management Center as explained in the Connecting Hazelcast members to Management Center section in the Hazelcast Management Center documentation.
To get the best performance, the correct cipher suites need to be configured. Each cipher suite has different performance and security characteristics and depending on the hardware and selected cipher suite, the overhead of TLS can range from dramatic to almost negligible.
The cipher suites are configured using the
ciphersuites property as shown below:
<hazelcast> ... <network> <ssl enabled="true"> <factory-class-name>...</factory-class-name> <properties> <property name="keyStore">upload/hazelcast.keystore</property> <property name="ciphersuites">TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA</property> </properties> </ssl> </network> ... </hazelcast>
hazelcast: network: ssl: enabled: true factory-class-name: ... properties: keyStore: upload/hazelcast.keystore ciphersuites: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
ciphersuites property accepts a comma separated list (spaces, enters, tabs are
filtered out) of cipher suites in the order
You can configure a member and client with different cipher suites; but there should be at least one shared cipher suite.
One of the cipher suites that gave very low overhead but still provides solid security
However in our measurements this cipher suite only performs well using OpenSSL; using
the regular Java TLS integration, it performs
badly. So keep that in mind when configuring a client using regular SSL and a member
Please check with your security expert to determine which cipher suites are appropriate and run performance tests to see which ones perform well in your environment.
If you don’t configure the cipher suites, then both client and/or member determine a cipher suite by themselves during the TLS/SSL handshake. This can lead to suboptimal performance and lower security than required.
You can set all the properties presented in this section using the
Also note that these properties can be specified using the related Java system properties and
-D command line
option. This is very useful if you require a more flexible configuration, e.g., when doing
See below examples equivalent to each other:
Another two examples equivalent to each other: