You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Neo4j security model is stored in the system graph, which is maintained in the xref:database-administration/index.adoc#manage-databases-system[`system` database].
84
84
All administrative commands need to be executed against it.
85
-
When connected to the DBMS over xref:configuration/connectors.adoc[], administrative commands are automatically routed to the `system` database.
85
+
When connected to the DBMS over xref:configuration/connectors.adoc[Configure network connectors], administrative commands are automatically routed to the `system` database.
Copy file name to clipboardExpand all lines: modules/ROOT/pages/configuration/configuration-settings.adoc
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -889,7 +889,7 @@ m|+++PRIMARY+++
889
889
890
890
Connection settings control the communication between servers and between a server and a client.
891
891
Neo4j provides support for Bolt, HTTP, and HTTPS protocols via connectors.
892
-
For more information about the connectors, see xref:configuration/connectors.adoc[Configure connectors].
892
+
For more information about the connectors, see xref:configuration/connectors.adoc[Configure network connectors].
893
893
894
894
When configuring the HTTPS or xref:/performance/bolt-thread-pool-configuration.adoc[Bolt], see also <<_security_settings>> and xref:security/ssl-framework.adoc[SSL framework] for details on how to work with SSL certificates.
For more information on configuring SSL policies, see xref:security/ssl-framework.adoc#ssl-configuration[Configuration].
79
79
80
-
For more information on configuring connectors, see xref:configuration/connectors.adoc#connectors-configuration-options[Configuration options].
80
+
For more information on configuring network connectors, see xref:configuration/connectors.adoc#connectors-configuration-options[Configure network connectors -> Configuration options].
Copy file name to clipboardExpand all lines: modules/ROOT/pages/security/ssl-framework.adoc
+50-97Lines changed: 50 additions & 97 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,70 +18,37 @@ This page describes how to set up SSL within your environment, how to view, vali
18
18
19
19
The secure networking in Neo4j is provided through the Netty library, which supports both the native JDK SSL provider as well as Netty-supported OpenSSL derivatives.
20
20
Each version of Neo4j ships with a version of Netty and Netty requires a specific version of the `netty-tcnative` library for compatibility, which can be found in the `lib/` directory of the Neo4j installation.
21
+
2025.01.0 ships with _Netty 2.0.69.Final_ and requires _netty-tcnative-boringssl-static-2.0.69.Final_.
21
22
22
-
Follow these steps to use OpenSSL:
23
+
// To uncomment the following when the table contains more than one entry.
24
+
//==================================
25
+
// The following table shows information about supported Neo4j versions and the required `netty-tcnative` dependency.
26
+
// If a Neo4j version is not listed, use the table entry for the previous Neo4j version.
27
+
28
+
// .Netty-TCNative support per Neo4j version
29
+
// [options="header,autowidth", cols="1,4"]
30
+
// |===
31
+
// | Neo4j version
32
+
// | tcnative version
23
33
24
-
* Install a suitable `netty-tcnative` dependency into the `plugins/` directory of Neo4j.
25
-
** Dependencies can be downloaded from https://netty.io/wiki/forked-tomcat-native.html.
26
-
** Which `netty-tcnative` version you need depends upon the Neo4j version.
27
-
For versioning details, see the <<table, Netty support per Neo4j version>> table.
28
-
Make sure to install a build variant that matches your OS and architecture.
29
-
* Set `xref:configuration/configuration-settings.adoc#config_dbms.netty.ssl.provider[dbms.netty.ssl.provider]=OPENSSL`.
30
-
* Restart Neo4j.
34
+
// | 2025.01
35
+
// | 2.0.69.Final and netty-tcnative-boringssl-static-2.0.69.Final
36
+
// |===
31
37
32
38
[NOTE]
33
39
====
34
-
Using dynamic versions of tcnative will require installation of platform-specific dependency libraries as described in https://netty.io/wiki/forked-tomcat-native.html.
40
+
Using dynamic versions of tcnative requires installation of platform-specific dependency libraries as described in https://netty.io/wiki/forked-tomcat-native.html.
35
41
36
-
In most use cases, the statically linked `boringssl` variant of `netty-tcnative` will be sufficient to enable SSL encryption.
42
+
In most use cases, the statically linked `boringssl` variant of `netty-tcnative` is sufficient to enable SSL encryption.
37
43
====
38
44
39
-
The following table shows information about supported Neo4j versions and when the `netty-tcnative` dependency was updated.
40
-
If a Neo4j version is not listed, use the table entry for the previous Neo4j version.
41
-
42
-
[[table]]
43
-
.Netty-TCNative support per Neo4j version
44
-
[options="header,autowidth", cols="1,4,2"]
45
-
|===
46
-
| Neo4j version
47
-
| tcnative version
48
-
| Direct link
49
-
50
-
| 5.23
51
-
| 2.0.65.Final. Only netty-tcnative-boringssl-static is required.
. Install a suitable `netty-tcnative` dependency into the `plugins/` directory of Neo4j.
48
+
Which `netty-tcnative` version you need depends on your OS and architecture.
49
+
. Set `xref:configuration/configuration-settings.adoc#config_dbms.netty.ssl.provider[dbms.netty.ssl.provider]=OPENSSL`.
83
50
Using OpenSSL can significantly improve performance, especially for AES-GCM-cryptos, e.g. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.
84
-
====
51
+
. Restart Neo4j.
85
52
86
53
[[ssl-certificates]]
87
54
== Certificates and private keys
@@ -110,21 +77,21 @@ To achieve this, you should concatenate each PEM-encoded certificate, starting f
110
77
111
78
[TIP]
112
79
====
113
-
If the same certificates are used across all instances of the cluster, make sure that when generating the certificates to include the DNS names of all the cluster instances in the certificates.
80
+
If the same certificates are used across all instances of the cluster, ensure that the DNS names of all cluster instances are included in the certificates when generating them.
114
81
Multi-host and wildcard certificates are also supported.
115
82
====
116
83
117
84
[TIP]
118
85
====
119
86
If setting up intra-cluster encryption as part of a cluster configuration, ensure that the certificates used on the cluster endpoint support server and client usage.
120
-
This is because when connecting between the Neo4j servers for clustering, each server uses its own certificate to authenticate as a client on the connection to another server.
87
+
This is because when connecting the servers for clustering, each server uses its own certificate to authenticate as a client on the connection to another server.
121
88
122
89
This could be verified from within the certificate details:
123
90
124
91
----
125
92
openssl x509 -in public.crt -noout -text
126
93
----
127
-
We should see that the X509v3 Extended Key Usage section shows both the usages listed:
94
+
You should see that the X509v3 Extended Key Usage section shows both the usages listed:
Before enabling SSL support, you must ensure the following connector configurations to avoid errors:
203
+
Before enabling SSL support, you must ensure the following network connector configurations to avoid errors:
237
204
238
205
* Set `server.https.enabled` to `true` when using HTTPS.
239
206
* Set `server.bolt.tls_level` to `REQUIRED` or `OPTIONAL` when using Bolt.
240
207
241
-
For more information on configuring connectors, see xref:configuration/connectors.adoc[Configure connectors].
208
+
For more information on configuring network connectors, see xref:configuration/connectors.adoc[Configure network connectors].
242
209
243
210
[[ssl-configuration]]
244
211
== Configuration
@@ -263,7 +230,7 @@ The SSL policies are configured by assigning values to parameters of the followi
263
230
| `trusted_dir` | A directory populated with certificates of trusted parties. | `trusted/`
264
231
| `revoked_dir` | A directory populated with certificate revocation lists (CRLs). | `revoked/`
265
232
3+^.^| *Advanced*
266
-
| `verify_hostname` footnote:[In Neo4j 2025.01, the default value is changed from `false` to `true`.] | Enabling this setting turns on client-side hostname verification.
233
+
| `verify_hostname` footnote:[In Neo4j 2025.01, the default value is changed from `false` to `true`.] | This setting turns on client-side hostname verification.
267
234
After receiving the server's public certificate, the client compares the
268
235
address it uses against the certificate Common Name (CN) and Subject Alternative
269
236
Names (SAN) fields.
@@ -293,9 +260,7 @@ Note that the existence of the directories, the certificate file, and the privat
293
260
Ensure that only the Neo4j user can read the private key.
294
261
====
295
262
296
-
Each policy needs to be explicitly enabled by setting:
297
-
298
-
`dbms.ssl.policy.<scope>.enabled=true`
263
+
Each policy needs to be explicitly enabled by setting `dbms.ssl.policy.<scope>.enabled=true`.
299
264
300
265
[[ssl-bolt-config]]
301
266
=== Configure SSL over Bolt
@@ -450,10 +415,8 @@ server.bolt.tls_level=REQUIRED (default is DISABLED)
450
415
+
451
416
[TIP]
452
417
====
453
-
In Neo4j version 3.5, the default value is `OPTIONAL`.
454
-
In the Neo4j 4.x versions, the default value is `DISABLED`, where only unencrypted client connections are to be accepted by this connector, and all encrypted connections will be rejected.
455
-
Use `REQUIRED` when only encrypted client connections are to be accepted by this connector, and all unencrypted connections will be rejected.
456
-
Use `OPTIONAL` where either encrypted or unencrypted client connections are accepted by this connector.
418
+
`REQUIRED` means the connector accepts only encrypted client connections and reject the unencrypted ones.
419
+
`OPTIONAL` means the connector accepts either encrypted or unencrypted client connections.
457
420
====
458
421
459
422
. Test the SSL connection to the specified host and Bolt port and view the certificate:
@@ -514,15 +477,17 @@ or
514
477
cypher-shell -a bolt+s://<Server DNS or IP>:<Bolt port>
515
478
----
516
479
517
-
Neo4j Browser::
518
-
From the *Connect URL* dropdown menu, select the URI scheme you want to use (`neo4j+s` or `bolt+s`).
519
-
+
520
-
[NOTE]
521
-
====
522
-
URI schemes ending `+ssc` are not supported by Neo4j Browser since the browser’s OS handles certificate trust.
523
-
If it is necessary to connect to a Neo4j instance using a self-signed certificate from Neo4j Browser, first visit a web page that uses the self-signed certificate in order to prompt the browser to request that certificate trust be granted.
524
-
Once that trust has been granted, you can connect with URI schemes ending `+s`.
525
-
====
480
+
// This should be described in the Browser guide, not here.
481
+
// ===========================
482
+
// Neo4j Browser::
483
+
// From the *Connect URL* dropdown menu, select the URI scheme you want to use (`neo4j+s` or `bolt+s`).
484
+
// +
485
+
// [NOTE]
486
+
// ====
487
+
// URI schemes ending `+ssc` are not supported by Neo4j Browser since the browser’s OS handles certificate trust.
488
+
// If it is necessary to connect to a Neo4j instance using a self-signed certificate from Neo4j Browser, first visit a web page that uses the self-signed certificate in order to prompt the browser to request that certificate trust be granted.
489
+
// Once that trust has been granted, you can connect with URI schemes ending `+s`.
The policy must be configured on every server with the same settings.
833
-
The actual xref:security/ssl-framework.adoc#term-ssl-cryptographic-objects[cryptographic objects] installed will be mostly different since they do not share the same private keys and corresponding certificates.
798
+
The actual xref:security/ssl-framework.adoc#term-ssl-cryptographic-objects[cryptographic objects] installed will mostly be different since they do not share the same private keys and corresponding certificates.
834
799
The trusted CA certificate will be shared however.
The hostname and port have to be adjusted according to your configuration.
848
-
This can prove that TLS is in fact enabled and that only the intended cipher suites are enabled.
813
+
This can prove that TLS is enabled and that only the intended cipher suites are enabled.
849
814
All servers and all applicable ports should be tested.
850
815
If the intra-cluster encryption is enabled, the output should indicate the port is open and it is using TLS with the ciphers used.
851
816
====
@@ -1066,22 +1031,10 @@ For more information, see xref:configuration/command-expansion.adoc[Command expa
1066
1031
There are cases where Neo4j Enterprise requires the use of specific ciphers for encryptions.
1067
1032
One can set up a Neo4j configuration by specifying the list of cipher suites that will be allowed during cipher negotiation.
1068
1033
Valid values depend on the current JRE and SSL provider.
1069
-
For Oracle JRE here is the list of supported ones - https://docs.oracle.com/en/java/javase/17/docs/specs/security/standard-names.html#jsse-cipher-suite-names.
1034
+
For Oracle JRE here is the list of supported ones - https://docs.oracle.com/en/java/javase/21/docs/specs/security/standard-names.html#jsse-cipher-suite-names.
1070
1035
1071
-
[role=label--deprecated-5.26]
1072
-
[IMPORTANT]
1073
-
====
1074
-
1075
-
CBC (cipher block chaining) ciphers, as used in TLS v1.2 network encryption, have several security vulnerabilities that make them less secure than alternative methods.
1076
-
The Internet Engineering Task Force (IETF) does not recommend using CBC-based ciphers (RFC 8447), and these ciphers were removed from the TLS standard with the development of TLS v1.3.
1077
-
1078
-
Note that the use of the following CBC-based ciphers are deprecated from Neo4j 5.26:
1079
-
1080
-
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
1081
-
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
1082
-
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
1083
-
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
1084
-
====
1036
+
Note that CBC (cipher block chaining)-based ciphers (RFC 8447), used in TLS v1.2 network encryption, are not supported in 2025.01.
1037
+
See xref:changes-deprecations-removals.adoc[] for more information.
0 commit comments