Configuring Cloud Native Compiler with SSL Authentication
While you can use Cloud Native Compiler (CNC) without SSL authentication for development and evaluation, it is highly recommended that you run your production CNC with SSL authentication.
To enable SSL authentication on your CNC:
Establish your SSL certificate. In order to enable SSL encryption of the communication between the JVM and Connected Compiler Service, you will need to provide a certificate and a corresponding private key in the
The common name field in the certificate must match the name of the CNC service as provided to client JVMs via the
—XX:CNCHostflag. Otherwise there may be issues when connecting.
Enable SSL in your
values-overrride.yamlfile:ssl: enabled: true
Add your certificate and private key. This can be done in several ways:
The most secure way to add certificates is using a separate chain that manages your certificate. You can then point the deployment to a custom secret in the installation namespace. Such a secret needs to have keys named
key.pem.ssl: secretName: "my-custom-secret"
You can add the certificate and private keys directly to the values.yaml as values. This is the simplest way to run quick experiments in a controlled environment, especially when you’re installing from the Helm repository. We do not recommend this approach in production as it embeds private security credentials in a config file:ssl: value: cert: |- -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- key: |- -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY-----
If you downloaded and unpacked the Helm chart to a local directory, you can just place files named
key.peminto the root directory of your Helm chart.
Perform Helm installation as shown in the general installation guide.
Running Azul Zulu Prime JDK Clients with SSL
By default, the Azul Zulu Prime JDK connects to CNC using SSL. If you installed without enabling SSL, you must use the
-XX:+CNCInsecure flag to instruct the Azul Zulu Prime JDK to allow unsecured connections to CNC.
If you attempt to connect to a CNC that is running without SSL and do not specify the
-XX:+CNCInsecure flag, you get the following error:
E1011 13:16:23.198074100 29 ssl_transport_security.cc:1446] Handshake failed with fatal error SSL_ERROR_SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number.
To connect to CNC using SSL, make sure the service certificate is trusted by the client server where you run Azul Zulu Prime JDK. This can be achieved by having the certificate signed by a publicly trusted certificate authority. If you have an internal CA trusted within the company infrastructure, make sure it is trusted.
The exact process depends on your OS distribution. Follow the instructions for your OS distribution to register the certificate on your client server. For example, on Ubuntu-based distributions you run the following command:
sudo openssl x509 -in <path to cert.pem> -inform PEM -out /usr/local/share/ca-certificates/cert.crt sudo update-ca-certificates
Alternatively, you can explicitly instruct Azul Zulu Prime JDK to use and trust a specified certificate on the filesystem by using the
-XX:CNCSSLRootsPath=<path to cert.pem> flag.
If certificate validation fails, your
.pem file is missing or does not match the certificate that you uploaded to CNC, you get the following error:
[1.856s][info][concomp] [gRPCEvent] read error! [1.856s][info][concomp] [gRPC processing] BidiStreamWrapper is dying, finishing stream 0x7fbec00180f0 with status: failed to connect to all addresses (14)