Skip to content

Commit 2f6226e

Browse files
rrelledgerrelledge
authored
RS: Added crdb-cli and REST API examples to enable TLS after Active-Active database creation (#1955)
* DOC-5494 RS: Added crdb-cli and REST API examples to enable TLS after Active-Active database creation * DOC-5494 Copy edits and links * DOC-5494 Copied Active-Active TLS fixes and additions to RS 7.8 and 7.4 versions * DOC-5494 Reverted Active-Active TLS fixes and additions to RS 7.4 version
1 parent 818616f commit 2f6226e

File tree

2 files changed

+96
-4
lines changed

2 files changed

+96
-4
lines changed

‎content/operate/rs/7.8/security/encryption/tls/enable-tls.md

Lines changed: 48 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,9 +82,13 @@ rladmin tune db < db:id | name > mtls_allow_outdated_certs enabled
8282

8383
## Enable TLS for Active-Active cluster connections
8484

85-
You cannot enable or turn off TLS after the Active-Active database is created, but you can change the TLS configuration.
85+
You can enable TLS for Active-Active cluster connections when you create a database using the Cluster Manager UI, [`crdb-cli`]({{<relref "/operate/rs/7.8/references/cli-utilities/crdb-cli">}}), or the [REST API]({{<relref "/operate/rs/7.8/references/rest-api">}}).
8686

87-
To enable TLS for Active-Active cluster connections:
87+
If you need to enable or turn off TLS after the Active-Active database is created, you must use [`crdb-cli`]({{<relref "/operate/rs/7.8/references/cli-utilities/crdb-cli">}}) or the [REST API]({{<relref "/operate/rs/7.8/references/rest-api">}}).
88+
89+
### Enable TLS during database creation
90+
91+
To enable TLS for Active-Active cluster connections using the Cluster Manager UI:
8892

8993
1. During [database creation]({{<relref "/operate/rs/7.8/databases/active-active/create">}}), expand the **TLS** configuration section.
9094

@@ -96,6 +100,48 @@ To enable TLS for Active-Active cluster connections:
96100

97101
If you also want to require TLS for client connections, you must edit the Active-Active database configuration after creation. See [Enable TLS for client connections](#client) for instructions.
98102

103+
### Enable TLS after database creation
104+
105+
You can enable TLS for an existing Active-Active database using either `crdb-cli` or the REST API.
106+
107+
{{< multitabs id="enable-tls-post-creation"
108+
tab1="CLI"
109+
tab2="REST API" >}}
110+
111+
Run the following [`crdb-cli crdb update`]({{<relref "/operate/rs/7.8/references/cli-utilities/crdb-cli/crdb/update">}}) command:
112+
113+
```sh
114+
crdb-cli crdb update --crdb-guid <guid> --encryption true
115+
```
116+
117+
Replace `<guid>` with your Active-Active database's globally unique identifier.
118+
119+
-tab-sep-
120+
121+
You can use an [update database configuration]({{<relref "/operate/rs/7.8/references/rest-api/requests/bdbs#put-bdbs">}}) request to enable TLS.
122+
123+
To enable TLS for Active-Active database communications only:
124+
125+
```sh
126+
PUT https://<host>:9443/v1/bdbs/<database-id>
127+
{
128+
"enforce_client_authentication": "disabled",
129+
"tls_mode": "replica_ssl"
130+
}
131+
```
132+
133+
To enable TLS for all communications:
134+
135+
```sh
136+
PUT https://<host>:9443/v1/bdbs/<database-id>
137+
{
138+
"enforce_client_authentication": "disabled",
139+
"tls_mode": "enabled"
140+
}
141+
```
142+
143+
{{< /multitabs >}}
144+
99145
## Enable TLS for Replica Of cluster connections
100146

101147
{{<embed-md "replica-of-tls-config.md">}}

‎content/operate/rs/security/encryption/tls/enable-tls.md

Lines changed: 48 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,9 +81,13 @@ rladmin tune db < db:id | name > mtls_allow_outdated_certs enabled
8181

8282
## Enable TLS for Active-Active cluster connections
8383

84-
You cannot enable or turn off TLS after the Active-Active database is created, but you can change the TLS configuration.
84+
You can enable TLS for Active-Active cluster connections when you create a database using the Cluster Manager UI, [`crdb-cli`]({{<relref "/operate/rs/references/cli-utilities/crdb-cli">}}), or the [REST API]({{<relref "/operate/rs/references/rest-api">}}).
8585

86-
To enable TLS for Active-Active cluster connections:
86+
If you need to enable or turn off TLS after the Active-Active database is created, you must use [`crdb-cli`]({{<relref "/operate/rs/references/cli-utilities/crdb-cli">}}) or the [REST API]({{<relref "/operate/rs/references/rest-api">}}).
87+
88+
### Enable TLS during database creation
89+
90+
To enable TLS for Active-Active cluster connections using the Cluster Manager UI:
8791

8892
1. During [database creation]({{<relref "/operate/rs/databases/active-active/create">}}), expand the **TLS** configuration section.
8993

@@ -95,6 +99,48 @@ To enable TLS for Active-Active cluster connections:
9599

96100
If you also want to require TLS for client connections, you must edit the Active-Active database configuration after creation. See [Enable TLS for client connections](#client) for instructions.
97101

102+
### Enable TLS after database creation
103+
104+
You can enable TLS for an existing Active-Active database using either `crdb-cli` or the REST API.
105+
106+
{{< multitabs id="enable-tls-post-creation"
107+
tab1="CLI"
108+
tab2="REST API" >}}
109+
110+
Run the following [`crdb-cli crdb update`]({{<relref "/operate/rs/references/cli-utilities/crdb-cli/crdb/update">}}) command:
111+
112+
```sh
113+
crdb-cli crdb update --crdb-guid <guid> --encryption true
114+
```
115+
116+
Replace `<guid>` with your Active-Active database's globally unique identifier.
117+
118+
-tab-sep-
119+
120+
You can use an [update database configuration]({{<relref "/operate/rs/references/rest-api/requests/bdbs#put-bdbs">}}) request to enable TLS.
121+
122+
To enable TLS for Active-Active database communications only:
123+
124+
```sh
125+
PUT https://<host>:9443/v1/bdbs/<database-id>
126+
{
127+
"enforce_client_authentication": "disabled",
128+
"tls_mode": "replica_ssl"
129+
}
130+
```
131+
132+
To enable TLS for all communications:
133+
134+
```sh
135+
PUT https://<host>:9443/v1/bdbs/<database-id>
136+
{
137+
"enforce_client_authentication": "disabled",
138+
"tls_mode": "enabled"
139+
}
140+
```
141+
142+
{{< /multitabs >}}
143+
98144
## Enable TLS for Replica Of cluster connections
99145

100146
{{<embed-md "replica-of-tls-config.md">}}

0 commit comments

Comments
 (0)