Skip to content

Commit 367d92c

Browse files
gingerwizardgingerwizard
committed
fully tested
1 parent 6c2edb5 commit 367d92c

File tree

1 file changed

+98
-21
lines changed

1 file changed

+98
-21
lines changed

‎knowledgebase/enabling-ssl-with-lets-encrypt.md

Lines changed: 98 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -5,86 +5,163 @@ date: 2024-12-11
55

66
The following steps can be used to enable SSL for a single ClickHouse Server using [Let's Encrypt](https://letsencrypt.org/), a free, automated, and open Certificate Authority (CA) designed to make it easy for anyone to secure their websites with HTTPS. By automating the certificate issuance and renewal process, Let's Encrypt ensures websites remain secure without requiring manual intervention.
77

8-
**We assume ClickHouse has been installed at the standard package locations in the following guide. We use the domain `product-test-server.clickhouse.com` for all examples. Substitute your domain accordingly.**
8+
:::note
9+
We assume ClickHouse has been installed at the standard package locations in the following guide. We use the domain `product-test-server.clickhouse-dev.com` for all examples. Substitute your domain accordingly.
10+
:::
911

12+
1. Verify you have a DNS `A` or `AAAA` record pointing to your server. This can be achieved using the Linux tool `dig.` For example, the response for `product-test-server.clickhouse-dev.com` if using the Cloudflare DNS server `1.1.1.1`:
1013

11-
1. Verify you have a DNS `A` or `AAAA` record pointing to your server. This can be achieved using the Linux tool `dig.` For example, the response for `product-test-server.clickhouse.com` if using the Cloudflare DNS server `1.1.1.1`:
14+
<br/>
1215

1316
```bash
14-
dig @1.1.1.1 product-test-server.clickhouse.com
15-
16-
17-
17+
dig @1.1.1.1 product-test-server.clickhouse-dev.com
18+
19+
; <<>> DiG 9.18.28-0ubuntu0.22.04.1-Ubuntu <<>> @1.1.1.1 product-test-server.clickhouse-dev.com
20+
; (1 server found)
21+
;; global options: +cmd
22+
;; Got answer:
23+
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22315
24+
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
25+
26+
;; OPT PSEUDOSECTION:
27+
; EDNS: version: 0, flags:; udp: 1232
28+
;; QUESTION SECTION:
29+
;product-test-server.clickhouse-dev.com. IN A
30+
31+
;; ANSWER SECTION:
32+
product-test-server.clickhouse-dev.com. 300 IN A 34.248.59.9
33+
34+
;; Query time: 52 msec
35+
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
36+
;; WHEN: Thu Dec 12 09:37:33 UTC 2024
37+
;; MSG SIZE rcvd: 83
1838
```
1939
20-
Notice the section,
40+
Notice the section below confirming the presence of an A record.
2141
2242
```bash
23-
24-
43+
;; ANSWER SECTION:
44+
product-test-server.clickhouse-dev.com. 300 IN A 34.248.59.9
2545
```
2646
27-
Confirming the presence of an A record.
28-
2947
2. Open port 80 on your server. This port will be used for automatic certificate renewal using the ACME protocol with certbot. For AWS, this can be achieved by [modifying the instance's associated Security Group](https://repost.aws/knowledge-center/connect-http-https-ec2).
3048
49+
<br/>
50+
3151
![Open_Port_80_Security_Group](./images/lets-encrypt-ssl/port_80_security_group.png)
3252
3353
3. Install [`certbot`](https://certbot.eff.org/instructions) e.g. using `apt`
3454
55+
<br/>
56+
3557
```bash
3658
sudo apt install certbot
3759
```
3860
3961
4. Obtain an SSL certificate
4062
63+
<br/>
64+
4165
```bash
4266
sudo certbot certonly
67+
Saving debug log to /var/log/letsencrypt/letsencrypt.log
68+
69+
How would you like to authenticate with the ACME CA?
70+
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
71+
1: Spin up a temporary webserver (standalone)
72+
2: Place files in webroot directory (webroot)
73+
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
74+
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 1
75+
Please enter the domain name(s) you would like on your certificate (comma and/or
76+
space separated) (Enter 'c' to cancel): product-test-server.clickhouse-dev.com
77+
Requesting a certificate for product-test-server.clickhouse-dev.com
78+
79+
Successfully received certificate.
80+
Certificate is saved at: /etc/letsencrypt/live/product-test-server.clickhouse-dev.com/fullchain.pem
81+
Key is saved at: /etc/letsencrypt/live/product-test-server.clickhouse-dev.com/privkey.pem
82+
This certificate expires on 2025-03-12.
83+
These files will be updated when the certificate renews.
84+
Certbot has set up a scheduled task to automatically renew this certificate in the background.
85+
86+
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
87+
If you like Certbot, please consider supporting our work by:
88+
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
89+
* Donating to EFF: https://eff.org/donate-le
4390
```
4491
4592
:::note
46-
If you don't have a web server running on your server, use (1) so Certbot can use a standalone temporary web server.
93+
We don't have a web server running on our server, so use (1) allowing Certbot to use a standalone temporary web server.
4794
:::
4895
49-
Enter the full domain name of your server e.g. `product-test-server.clickhouse.com` when requested.
96+
Enter the full domain name of your server e.g. `product-test-server.clickhouse-dev.com` when requested.
5097
51-
::note
98+
:::note
5299
Let's Encrypt has a policy of not issuing certificates for certain types of domains, such as public cloud provider-generated domains (e.g., AWS *.compute.amazonaws.com domains). These domains are considered shared infrastructure and are blocked for security and abuse prevention reasons.
53100
:::
54101
55102
5. Copy certificates to the ClickHouse directory.
56103
104+
<br/>
105+
57106
```bash
58-
echo '* * * * * root cp -u /etc/letsencrypt/live/product-test-server.clickhouse.com/*.pem /etc/clickhouse-server/ && chown clickhouse:clickhouse /etc/clickhouse-server/*.pem && chmod 400 /etc/clickhouse-server/*.pem' | sudo tee /etc/cron.d/copy-certificates
107+
echo '* * * * * root cp -u /etc/letsencrypt/live/product-test-server.clickhouse-dev.com/*.pem /etc/clickhouse-server/ && chown clickhouse:clickhouse /etc/clickhouse-server/*.pem && chmod 400 /etc/clickhouse-server/*.pem' | sudo tee /etc/cron.d/copy-certificates
59108
```
60109
61110
This command sets up a cron job to automate the management of Let's Encrypt SSL certificates for a ClickHouse server. It runs every minute as the root user, copying the .pem files from the Let's Encrypt directory to the ClickHouse server's configuration directory, but only if the files have been updated. After copying, the script adjusts the ownership of the files to the clickhouse user and group, ensuring the server has the required access. It also sets secure read-only permissions (`chmod 400`) on the copied files to maintain strict file security. This ensures that the ClickHouse server always has access to the latest SSL certificates without requiring manual intervention, maintaining security and minimizing operational overhead.
62111
63112
6. Configure the use of these certificates in clickhouse-server.
64113
114+
<br/>
115+
65116
```bash
66-
echo"
67-
https_port: 8443
117+
echo "https_port: 8443
118+
tcp_port_secure: 9440
68119
openSSL:
69120
server:
70121
certificateFile: '/etc/clickhouse-server/fullchain.pem'
71122
privateKeyFile: '/etc/clickhouse-server/privkey.pem'
72-
disableProtocols: 'sslv2,sslv3,tlsv1,tlsv1_1'
73-
"| sudo tee /etc/clickhouse-server/config.d/ssl.yaml
123+
disableProtocols: 'sslv2,sslv3,tlsv1,tlsv1_1'" | sudo tee /etc/clickhouse-server/config.d/ssl.yaml
74124
```
75125
76126
7. Restart ClickHouse Server
77127
128+
<br/>
129+
78130
```bash
79131
sudo clickhouse restart
80132
```
81133
82134
8. Validate ClickHouse can communicate over SSL
83135
136+
<br/>
137+
84138
```bash
85-
curl https://product-test-server.clickhouse.com:8443/
139+
curl https://product-test-server.clickhouse-dev.com:8443/
140+
141+
Ok.
142+
```
86143
144+
For this last step to work you may need to ensure port 8443 is accessible e.g. included in your Security Group in AWS. Alternatively, if you only want to access ClickHouse from the server, modify your hosts file i.e.
145+
146+
```bash
147+
echo "127.0.0.1 product-test-server.clickhouse-dev.com" | sudo tee -a /etc/hosts
148+
```
87149
150+
:::warning
151+
If you open connections from wildcard addresses, make sure that at least one of the following measures is applied:
88152
153+
- server is protected by firewall and not accessible from untrusted networks;
154+
- all users are restricted to a subset of network addresses (see users.xml);
155+
- all users have strong passwords, only secure (TLS) interfaces are accessible, or connections are only made via TLS interfaces.
156+
- users without passwords have read-only access.
89157
90-
```
158+
See also: https://www.shodan.io/search?query=clickhouse
159+
160+
The blog [Building single page applications with ClickHouse](https://clickhouse.com/blog/building-single-page-applications-with-clickhouse-and-http) can be used as guidance for securing public instances.
161+
:::
162+
163+
The following should also work if connecting from the local machine on which ClickHouse is running. To connect via `product-test-server.clickhouse-dev.com` open port 9440 in your:
164+
165+
```bash
166+
clickhouse client --secure --user default --password <password>
167+
```

0 commit comments

Comments
 (0)