Skip to content

Commit 5549529

Browse files
rrelledgerrelledge
committed
DOC-5494 Copied Active-Active TLS fixes and additions to RS 7.8 and 7.4 versions
1 parent 36908d1 commit 5549529

File tree

3 files changed

+93
-31
lines changed

3 files changed

+93
-31
lines changed

‎content/operate/rs/7.4/security/encryption/tls/enable-tls.md‎

Lines changed: 45 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -85,48 +85,65 @@ rladmin tune db < db:id | name > mtls_allow_outdated_certs enabled
8585

8686
## Enable TLS for Active-Active cluster connections
8787

88-
To enable TLS for Active-Active cluster connections:
88+
You can enable TLS for Active-Active cluster connections when you create a database using the Cluster Manager UI, [`crdb-cli`]({{<relref "/operate/rs/7.4/references/cli-utilities/crdb-cli">}}), or the [REST API]({{<relref "/operate/rs/7.4/references/rest-api">}}).
8989

90-
1. If you are using the new Cluster Manager UI, switch to the legacy admin console.
90+
If you need to enable or turn off TLS after the Active-Active database is created, you must use [`crdb-cli`]({{<relref "/operate/rs/7.4/references/cli-utilities/crdb-cli">}}) or the [REST API]({{<relref "/operate/rs/7.4/references/rest-api">}}).
9191

92-
{{<image filename="images/rs/screenshots/switch-to-legacy-ui.png" width="300px" alt="Select switch to legacy admin console from the dropdown.">}}
92+
### Enable TLS during database creation
9393

94-
1. [Retrieve syncer certificates.](#retrieve-syncer-certificates)
94+
To enable TLS for Active-Active cluster connections using the Cluster Manager UI:
9595

96-
1. [Configure TLS certificates for Active-Active.](#configure-tls-certificates-for-active-active)
96+
1. During [database creation]({{<relref "/operate/rs/7.4/databases/active-active/create">}}), expand the **TLS** configuration section.
9797

98-
1. [Configure TLS on all participating clusters.](#configure-tls-on-all-participating-clusters)
98+
1. Select **On** to enable TLS.
9999

100-
{{< note >}}
101-
You cannot enable or turn off TLS after the Active-Active database is created, but you can change the TLS configuration.
102-
{{< /note >}}
100+
{{<image filename="images/rs/screenshots/databases/active-active-databases/enable-tls-for-active-active-db.png" alt="TLS is enabled on the Cluster Manager UI screen.">}}
103101

104-
### Retrieve syncer certificates
102+
1. Click **Create**.
105103

106-
For each participating cluster, copy the syncer certificate from the **general** settings tab.
104+
If you also want to require TLS for client connections, you must edit the Active-Active database configuration after creation. See [Enable TLS for client connections](#client) for instructions.
107105

108-
{{< image filename="/images/rs/general-settings-syncer-cert.png" alt="general-settings-syncer-cert" >}}
106+
### Enable TLS after database creation
109107

110-
### Configure TLS certificates for Active-Active
108+
You can enable TLS for an existing Active-Active database using either `crdb-cli` or the REST API.
111109

112-
1. During database creation (see [Create an Active-Active Geo-Replicated Database]({{< relref "/operate/rs/7.4/databases/active-active/create.md" >}}), select **Edit** from the **configuration** tab.
113-
1. Enable **TLS**.
114-
- **Enforce client authentication** is selected by default. If you clear this option, you will still enforce encryption, but TLS client authentication will be deactivated.
115-
1. Select **Require TLS for CRDB communication only** from the dropdown menu.
116-
{{< image filename="/images/rs/crdb-tls-all.png" alt="crdb-tls-all" >}}
117-
1. Select **Add** {{< image filename="/images/rs/icon_add.png#no-click" alt="Add" >}}
118-
1. Paste a syncer certificate into the text box.
119-
{{< image filename="/images/rs/database-tls-replica-certs.png" alt="Database TLS Configuration" >}}
120-
1. Save the syncer certificate. {{< image filename="/images/rs/icon_save.png#no-click" alt="Save" >}}
121-
1. Repeat this process, adding the syncer certificate for each participating cluster.
122-
1. Optional: If also you want to require TLS for client connections, select **Require TLS for All Communications** from the dropdown and add client certificates as well.
123-
1. Select **Update** at the bottom of the screen to save your configuration.
110+
{{< multitabs id="enable-tls-post-creation"
111+
tab1="CLI"
112+
tab2="REST API" >}}
124113

125-
### Configure TLS on all participating clusters
114+
Run the following [`crdb-cli crdb update`]({{<relref "/operate/rs/7.4/references/cli-utilities/crdb-cli/crdb/update">}}) command:
126115

127-
Repeat this process on all participating clusters.
116+
```sh
117+
crdb-cli crdb update --crdb-guid <guid> --encryption true
118+
```
119+
120+
Replace `<guid>` with your Active-Active database's globally unique identifier.
121+
122+
-tab-sep-
123+
124+
You can use an [update database configuration]({{<relref "/operate/rs/7.4/references/rest-api/requests/bdbs#put-bdbs">}}) request to enable TLS.
125+
126+
To enable TLS for Active-Active database communications only:
127+
128+
```sh
129+
PUT https://<host>:9443/v1/bdbs/<database-id>
130+
{
131+
"enforce_client_authentication": "disabled",
132+
"tls_mode": "replica_ssl"
133+
}
134+
```
135+
136+
To enable TLS for all communications:
137+
138+
```sh
139+
PUT https://<host>:9443/v1/bdbs/<database-id>
140+
{
141+
"enforce_client_authentication": "disabled",
142+
"tls_mode": "enabled"
143+
}
144+
```
128145

129-
To enforce TLS authentication, Active-Active databases require syncer certificates for each cluster connection. If every participating cluster doesn't have a syncer certificate for every other participating cluster, synchronization will fail.
146+
{{< /multitabs >}}
130147

131148
## Enable TLS for Replica Of cluster connections
132149

‎content/operate/rs/7.8/security/encryption/tls/enable-tls.md‎

Lines changed: 48 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,9 +82,13 @@ rladmin tune db < db:id | name > mtls_allow_outdated_certs enabled
8282

8383
## Enable TLS for Active-Active cluster connections
8484

85-
You cannot enable or turn off TLS after the Active-Active database is created, but you can change the TLS configuration.
85+
You can enable TLS for Active-Active cluster connections when you create a database using the Cluster Manager UI, [`crdb-cli`]({{<relref "/operate/rs/7.8/references/cli-utilities/crdb-cli">}}), or the [REST API]({{<relref "/operate/rs/7.8/references/rest-api">}}).
8686

87-
To enable TLS for Active-Active cluster connections:
87+
If you need to enable or turn off TLS after the Active-Active database is created, you must use [`crdb-cli`]({{<relref "/operate/rs/7.8/references/cli-utilities/crdb-cli">}}) or the [REST API]({{<relref "/operate/rs/7.8/references/rest-api">}}).
88+
89+
### Enable TLS during database creation
90+
91+
To enable TLS for Active-Active cluster connections using the Cluster Manager UI:
8892

8993
1. During [database creation]({{<relref "/operate/rs/7.8/databases/active-active/create">}}), expand the **TLS** configuration section.
9094

@@ -96,6 +100,48 @@ To enable TLS for Active-Active cluster connections:
96100

97101
If you also want to require TLS for client connections, you must edit the Active-Active database configuration after creation. See [Enable TLS for client connections](#client) for instructions.
98102

103+
### Enable TLS after database creation
104+
105+
You can enable TLS for an existing Active-Active database using either `crdb-cli` or the REST API.
106+
107+
{{< multitabs id="enable-tls-post-creation"
108+
tab1="CLI"
109+
tab2="REST API" >}}
110+
111+
Run the following [`crdb-cli crdb update`]({{<relref "/operate/rs/7.8/references/cli-utilities/crdb-cli/crdb/update">}}) command:
112+
113+
```sh
114+
crdb-cli crdb update --crdb-guid <guid> --encryption true
115+
```
116+
117+
Replace `<guid>` with your Active-Active database's globally unique identifier.
118+
119+
-tab-sep-
120+
121+
You can use an [update database configuration]({{<relref "/operate/rs/7.8/references/rest-api/requests/bdbs#put-bdbs">}}) request to enable TLS.
122+
123+
To enable TLS for Active-Active database communications only:
124+
125+
```sh
126+
PUT https://<host>:9443/v1/bdbs/<database-id>
127+
{
128+
"enforce_client_authentication": "disabled",
129+
"tls_mode": "replica_ssl"
130+
}
131+
```
132+
133+
To enable TLS for all communications:
134+
135+
```sh
136+
PUT https://<host>:9443/v1/bdbs/<database-id>
137+
{
138+
"enforce_client_authentication": "disabled",
139+
"tls_mode": "enabled"
140+
}
141+
```
142+
143+
{{< /multitabs >}}
144+
99145
## Enable TLS for Replica Of cluster connections
100146

101147
{{<embed-md "replica-of-tls-config.md">}}

‎content/operate/rs/security/encryption/tls/enable-tls.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,6 @@ rladmin tune db < db:id | name > mtls_allow_outdated_certs enabled
8181

8282
## Enable TLS for Active-Active cluster connections
8383

84-
8584
You can enable TLS for Active-Active cluster connections when you create a database using the Cluster Manager UI, [`crdb-cli`]({{<relref "/operate/rs/references/cli-utilities/crdb-cli">}}), or the [REST API]({{<relref "/operate/rs/references/rest-api">}}).
8685

8786
If you need to enable or turn off TLS after the Active-Active database is created, you must use [`crdb-cli`]({{<relref "/operate/rs/references/cli-utilities/crdb-cli">}}) or the [REST API]({{<relref "/operate/rs/references/rest-api">}}).

0 commit comments

Comments
 (0)