Configuring Cloud Native Compiler with SSL Authentication
While you can use Cloud Native Compiler (CNC) without SSL authentication for development and evaluation, it is highly recommended that you run your production CNC services with SSL authentication.
To enable SSL authentication on your CNC services:
Prepare your SSL certificate. In order to enable SSL encryption of the communication between the JVM and Connected Compiler Service, you will need to provide a certificate and a corresponding private key in the
The common name field in the certificate must match the domain name, to which your JVMs will be connecting. Otherwise there may be issues when connecting.
Enable SSL in your
values-overrride.yamlfile:ssl: enabled: true
Add your certificate and private key. This can be done in several ways:
Add as values. This is the simplest way, especially when you’re installing from the Helm repository:ssl: value: cert: |- -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- key: |- -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY-----
If you downloaded and unpacked the Helm chart to a local directory, you can just place files named
key.peminto the root directory of your Helm chart.
If neither of the options is suitable or you have a separate chain that manages your certificate, you can simply point the deployment at a custom secret in the installation namespace. Such a secret needs to have keys named
key.pem.ssl: secretName: "my-custom-secret"
Perform Helm installation as shown in the general installation guide.
By default, the Azul Zulu Prime JDK connects to the CNC service using SSL. If you installed without enabling SSL, you must use the
-XX:+CNCInsecure flag to instruct the Azul Zulu Prime JDK to allow unsecured connections to CNC.
If you attempt to connect to a CNC service that is running without SSL and do not specify the
-XX:+CNCInsecure flag, you get the following error:
E1011 13:16:23.198074100 29 ssl_transport_security.cc:1446] Handshake failed with fatal error SSL_ERROR_SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number.
To connect to the CNC service using SSL, make sure the service certificate is trusted by the client server where you run Azul Zulu Prime JDK. This can be achieved by having the certificate signed by a publicly trusted certificate authority. If you have an internal CA trusted within the company infrastructure, make sure it is trusted.
The exact process depends on your OS distribution. Follow the instructions for your OS distribution to register the certificate on your client server. For example, on Ubuntu-based distributions you run the following command:
sudo openssl x509 -in <path to cert.pem> -inform PEM -out /usr/local/share/ca-certificates/cert.crt sudo update-ca-certificates
Alternatively, you can explicitly instruct Azul Zulu Prime JDK to use and trust a specified certificate on the filesystem by using the
-XX:CNCSSLRootsPath=<path to cert.pem> flag.
If certificate validation fails, your
.pem file is missing or does not match the certificate that you uploaded to the CNC service, you get the following error:
[1.856s][info][concomp] [gRPCEvent] read error! [1.856s][info][concomp] [gRPC processing] BidiStreamWrapper is dying, finishing stream 0x7fbec00180f0 with status: failed to connect to all addresses (14)