Visit Support

Configuring Cloud Native Compiler with SSL Authentication

While you can use Cloud Native Compiler (CNC) without SSL authentication for development and evaluation, it is highly recommended that you run your production CNC services with SSL authentication.

To enable SSL authentication on your CNC services:

  1. Prepare your SSL certificate. In order to enable SSL encryption of the communication between the JVM and Connected Compiler Service, you will need to provide a certificate and a corresponding private key in the pem format.

    The common name field in the certificate must match the domain name, to which your JVMs will be connecting. Otherwise there may be issues when connecting.
  2. Enable SSL in your values-overrride.yaml file:

    ssl: enabled: true
  3. Add your certificate and private key. This can be done in several ways:

    1. Add as values. This is the simplest way, especially when you’re installing from the Helm repository:

      ssl: value: cert: |- -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- key: |- -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY-----
    2. If you downloaded and unpacked the Helm chart to a local directory, you can just place files named cert.pem and key.pem into the root directory of your Helm chart.

    3. If neither of the options is suitable or you have a separate chain that manages your certificate, you can simply point the deployment at a custom secret in the installation namespace. Such a secret needs to have keys named cert.pem and key.pem.

      ssl: secretName: "my-custom-secret"
  4. Perform Helm installation as shown in the general installation guide.

Running Azul Zulu Prime JDK Clients with SSL

By default, the Azul Zulu Prime JDK connects to the CNC service using SSL. If you installed without enabling SSL, you must use the -XX:+CNCInsecure flag to instruct the Azul Zulu Prime JDK to allow unsecured connections to CNC.

If you attempt to connect to a CNC service that is running without SSL and do not specify the -XX:+CNCInsecure flag, you get the following error:

E1011 13:16:23.198074100 29] Handshake failed with fatal error SSL_ERROR_SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number.

To connect to the CNC service using SSL, make sure the service certificate is trusted by the client server where you run Azul Zulu Prime JDK. This can be achieved by having the certificate signed by a publicly trusted certificate authority. If you have an internal CA trusted within the company infrastructure, make sure it is trusted.

The exact process depends on your OS distribution. Follow the instructions for your OS distribution to register the certificate on your client server. For example, on Ubuntu-based distributions you run the following command:

sudo openssl x509 -in <path to cert.pem> -inform PEM -out /usr/local/share/ca-certificates/cert.crt sudo update-ca-certificates

Alternatively, you can explicitly instruct Azul Zulu Prime JDK to use and trust a specified certificate on the filesystem by using the -XX:CNCSSLRootsPath=<path to cert.pem> flag.

If certificate validation fails, your .pem file is missing or does not match the certificate that you uploaded to the CNC service, you get the following error:

[1.856s][info][concomp] [gRPCEvent] read error! [1.856s][info][concomp] [gRPC processing] BidiStreamWrapper is dying, finishing stream 0x7fbec00180f0 with status: failed to connect to all addresses (14)