Scene Description

Users can enable TLS communication through simple configuration to ensure data transmission security.

External Service Communication Configuration

The configuration related to external service communication is written in the microservice.yaml file.

• Service Center, Configuration Center TLS communication configuration The connection between the microservices and the service center and the configuration center can be enabled by changing http to https. The configuration example is as follows:

  servicecomb:
    service:
      registry:
        address: https://127.0.0.1:30100
    config:
      client:
        serverUri: https://127.0.0.1:30103
  

• Service provider enables TLS communication When the service provider configures the service listening address, it can open TLS communication by appending ?sslEnabled=true to the address. The example is as follows:

  servicecomb:
    rest:
      address: 0.0.0.0:8080?sslEnabled=true
    highway:
      address: 0.0.0.0:7070?sslEnabled=true
  

Certificate Configuration

The certificate configuration item is written in the microservice.yaml file. It supports the unified development of certificates. It can also add tags for finer-grained configuration. The tag configuration overrides the global configuration. The configuration format is as follows:

ssl.[tag].[property]

The common tags are as follows:

Generally, there is no need to configure tags. The normal situation is divided into three categories: 1. Connecting internal services 2. As a server 3. As a client, if the certificates required by these three types are inconsistent, then you need to use tags to distinguish

The certificate configuration items are shown in Table 1. Certificate Configuration Item Description Table. Table 1 Certificate Configuration Item Description Table

Description:

• The default protocol algorithm is a high-intensity encryption algorithm. The JDK needs to install the corresponding policy file. Reference: http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html. You can use a non-high-intensity algorithm in your profile configuration.
• Microservice consumers, can specify certificates for different providers (current certificates are issued according to HOST, different providers use a certificate storage medium, this medium is also used by the microservice access service center and configuration center ).

Sample Code

An example of a configuration for enabling TLS communication in the microservice.yaml file is as follows:

servicecomb:
  service:
    registry:
      address: https://127.0.0.1:30100
  config:
    client:
      serverUri: https://127.0.0.1:30103
  rest:
    address: 0.0.0.0:8080?sslEnabled=true
  highway:
    address: 0.0.0.0:7070?sslEnabled=true

#########SSL options
ssl.protocols: TLSv1.2
ssl.authPeer: true
ssl.checkCN.host: true

#########certificates config
ssl.trustStore: trust.jks
ssl.trustStoreType: JKS
ssl.trustStoreValue: Changeme_123
ssl.keyStore: server.p12
ssl.keyStoreType: PKCS12
ssl.keyStoreValue: Changeme_123
ssl.crl: revoke.crl
ssl.sslCustomClass: org.apache.servicecomb.demo.DemoSSLCustom