Is it possible to encrypt cluster communications in a shared-nothing cluster? | Community
Skip to main content
steve_sedlmeyer
steve_sedlmeyer
October 16, 2015
Solved

Is it possible to encrypt cluster communications in a shared-nothing cluster?

  • October 16, 2015
  • 3 replies
  • 837 views

I have a requirement to encrypt traffic between cluster nodes, specifically between the nodes of a CRX shared-nothing cluster.  Is it possible to configure SSL or some other encryption for that traffic?  Bonus points if it's also possible to implement certificate based mutual authentication between the cluster nodes....

If it's not possible out of the box, is there an interface I can implement to provide my own transport for the replication?

 

Thanks in advance,

Steve Sedlmeyer

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by joerghoh

Hi Steve,

no, the cluster communication is not encrypted by default; also I am not aware of any possibility to encrypt it on a repository level. You also cannot code it yourself. Normally this shouldn't be necessary, because the cluster is suppossed to run in a secured network. But you can route the cluster communication through a VPN channel you build between the cluster nodes.

Just as a side note: Do not confuse this cluster communication with "replication". These concepts are totally different.

regards,

Jörg

3 replies

joerghoh
Adobe Employee
joerghohAdobe EmployeeAccepted solution
Adobe Employee
October 16, 2015

Hi Steve,

no, the cluster communication is not encrypted by default; also I am not aware of any possibility to encrypt it on a repository level. You also cannot code it yourself. Normally this shouldn't be necessary, because the cluster is suppossed to run in a secured network. But you can route the cluster communication through a VPN channel you build between the cluster nodes.

Just as a side note: Do not confuse this cluster communication with "replication". These concepts are totally different.

regards,

Jörg

steve_sedlmeyer
steve_sedlmeyerAuthor
October 16, 2015

Thanks Jörg,

 It looks like there's a VPN in my future because, as my customer would tell you, "secure network" is a lot like "political integrity" in that there pretty much is no such thing.

Also thanks for the reminder on Replication vs. cluster communications, we're pretty clear on the topic.  I've already implemented SSL for that communications channel.

Thanks again,

Steve

joerghoh
Adobe Employee
joerghohAdobe Employee
Adobe Employee
October 16, 2015

Anyway, be aware that encryption adds an additional layer of complexity and potential problems on top. Also you might have an impact on latency. And when you talk about VPN and stuff like that: I hope that you are aware that the TarPM cluster really likes low latency? I haven't make good experience with cluster nodes being distributed over multiple datacenters.

Jörg

Terms & ConditionsAccessibility statement

Loading footer...