This topic describes how to configure for wire encryption.
Wire encryption provides confidentiality and privacy to two parties communicating over a public network. The two parties may also need to prove their identity to each other: authentication is the process of proving identity.
In Dremio, Transport Layer Security (TLS), previously called Secure Socket Layer, is the protocol used to establish an encrypted communication channel between two parties.
Dremio supports the following TLS wire encryption methods:
All Dremio clusters must have the following configured:
- One or more coordinator nodes with the master-coordinator role. See High Availability for a multiple coordinator node environment.
- One or more executor nodes.
In a cluster environment (not a single node install), a node can only have a single role: as either a master-coordinator or an executor. In addition, a coordinator-only role is not supported. A coordinator node refers to a node with the master-coordinator role enabled.
Prior to configuring your Dremio environment for wire encryption, the file permissions on the keystore, truststore, and dremio.conf files must be set correctly. The following file permissions must be set:
To configure Dremio to use encryption for all web server, client-server, and intracluster communication using the same keystore and truststore, set the following properties in the dremio.conf file on all of your Dremio coordinator and executor nodes in the cluster.
Full Wire encryption is a Enterprise Edition feature only.
Full Wire Encryption Configuration
javax.net.ssl.keyStoreType: "type" # optional; default: JKS
javax.net.ssl.keyStore: "path/to/keystore/jks/file"
javax.net.ssl.keyStorePassword: "keystorePassword"
javax.net.ssl.keyPassword: "key password"
javax.net.ssl.trustStoreType: "type" # optional; default: JKS
javax.net.ssl.trustStore: "path/to/truststore/jks/file"
javax.net.ssl.trustStorePassword: "trustStorePassword"
services.coordinator.client-endpoint.ssl.enabled: true
services.coordinator.client-endpoint.ssl.auto-certificate.enabled: false
services.coordinator.web.ssl.enabled: true
services.coordinator.web.ssl.auto-certificate.enabled: false
services.fabric.ssl.enabled: true
services.fabric.ssl.auto-certificate.enabled: false
To configure the Dremio web server to use HTTPS, set the keyStore and trustStore properties in the dremio.conf file on all of your Dremio coordinator nodes.
Web Server Encryption Configuration
services.coordinator.web.ssl.enabled: true
services.coordinator.web.ssl.auto-certificate.enabled: false
services.coordinator.web.ssl.keyStore: "path/to/keystore/jks/file",
services.coordinator.web.ssl.keyStorePassword: "keystorePassword",
services.coordinator.web.ssl.trustStore: "path/to/trustStore", (Optional)
services.coordinator.web.ssl.trustStorePassword: "trustStorePassword" (Optional)
Generating a self-signed certificate
WARNING: Using a self-signed certificate in production is not recommended for security reasons. Most browsers will also warn you if Dremio’s web server is configured with a self-signed certificate.
To configure Dremio to use self-signed certificates for Dremio web server encryption, add the following parameters to dremio.conf on all of your coordinator nodes.
services.coordinator.web.ssl.enabled: true
services.coordinator.web.ssl.auto-certificate.enabled: true
Transport Layer Security (TLS) communication is supported for encrypting communication between ODBC/JDBC client applications and the Dremio server.
ODBC/JDBC encryption is a Enterprise Edition feature only.
To configure Dremio to use TLS for client-server encryption:
To enable ODBC/JDBC client encryption for Dremio, add the following keyStore and trustStore properties to the dremio.conf file on all of your Dremio coordinator nodes:
services.coordinator.client-endpoint.ssl.enabled: true
services.coordinator.client-endpoint.ssl.auto-certificate.enabled: false
services.coordinator.client-endpoint.ssl.keyStoreType: "type" # optional; default: JKS
services.coordinator.client-endpoint.ssl.keyStore: "path/to/keystore/jks/file"
services.coordinator.client-endpoint.ssl.keyStorePassword: "file password"
services.coordinator.client-endpoint.ssl.keyPassword: "key password"
services.coordinator.client-endpoint.ssl.trustStoreType: "type" # optional; default: JKS
services.coordinator.client-endpoint.ssl.trustStore: "path/to/truststore/jks/file"
services.coordinator.client-endpoint.ssl.trustStorePassword: "file password"
Generating a self-signed certificate
WARNING: Using a self-signed certificate in production is not recommended for security reasons.
To configure Dremio to use self-signed certificates for client-server encryption, add the following parameters to dremio.conf on your coordinator nodes.
services.coordinator.client-endpoint.ssl.enabled: true
services.coordinator.client-endpoint.ssl.auto-certificate.enabled: true
Transport Layer Security (TLS) communication is support for encrypting communication between Dremio nodes in a cluster. This communication is between coordinator-executor and executor-executor nodes.
Intracluster encryption is a Enterprise Edition feature only.
To configure Dremio to use TLS for intracluster encryption, set the keyStore and trustStore properties in the dremio.conf file on all of your Dremio coordinator and executor nodes.
Intracluster Encryption Configuration
services.fabric.ssl.enabled: true
services.fabric.ssl.auto-certificate.enabled: false
services.fabric.ssl.keyStoreType: "type" # optional; default: JKS
services.fabric.ssl.keyStore: "path/to/keystore/jks/file"
services.fabric.ssl.keyStorePassword: "file password"
services.fabric.ssl.keyPassword: "key password"
services.fabric.ssl.trustStoreType: "type" # optional; default: JKS
services.fabric.ssl.trustStore: "path/to/truststore/jks/file"
services.fabric.ssl.trustStorePassword: "file password"
Generating a self-signed certificate
WARNING: Using a self-signed certificate in production is not recommended for security reasons.
To configure Dremio to use self-signed certificates for intracluster encryption, add the following parameters to dremio.conf on all of your coordinator and executor nodes.
services.fabric.ssl.enabled: true
services.fabric.ssl.auto-certificate.enabled: true