Configuring Optimizer Hub with SSL Authentication

Table of Contents

Running Zing Clients with SSL

Need help?

Schedule a consultation with an Azul performance expert.

While you can use Optimizer Hub without SSL authentication for development and evaluation, it is highly recommended that you run your production Optimizer Hub with SSL authentication.

To enable SSL authentication on your Optimizer Hub:

Establish your SSL certificate. To enable SSL encryption of the communication between the JVM and Optimizer Hub, you need to provide a certificate and a corresponding private key in the pem format.

Note	The common name field in the certificate must match the name of the Optimizer Hub service as provided to client JVMs via the `—XX:OptHubHost` flag. Otherwise there may be issues when connecting.

Enable SSL in your values-overrride.yaml file:
```
 ssl:
  enabled: true
```
Add your certificate and private key. This can be done in several ways:
1. The most secure way to add certificates is using a separate chain that manages your certificate. You can then point the deployment to a custom secret in the installation namespace. Such a secret needs to have keys named cert.pem and key.pem.
```
 ssl:
  secretName: "my-custom-secret"
```
2. You can add the certificate and private keys directly to the values.yaml as values. This is the simplest way to run quick experiments in a controlled environment, especially when you’re installing from the Helm repository. We do not recommend this approach in production as it embeds private security credentials in a config file:
```
 ssl:
  value:
    cert: |-
      -----BEGIN CERTIFICATE-----
      ...
      -----END CERTIFICATE-----
    key: |-
      -----BEGIN PRIVATE KEY-----
      ...
      -----END PRIVATE KEY-----
```
3. If you downloaded and unpacked the Helm chart to a local directory, you can just place files named cert.pem and key.pem into the root directory of your Helm chart.
Perform Helm installation as shown in the general installation guide.

Running Zing Clients with SSL

By default, Zing connects to Optimizer Hub using SSL. If you installed without enabling SSL, you must use the -XX:-OptHubUseSSL flag to instruct Zing to allow unsecured connections to Optimizer Hub.

Note	Before version 1.8.0 the flag was called `-XX:+/-CNCInsecure`. Because of this change, you need to review your settings.

If you attempt to connect to a Optimizer Hub that is running without SSL and do not specify the -XX:-OptHubUseSSL flag, you get the following error:

 E1011 13:16:23.198074100      29 ssl_transport_security.cc:1446]
Handshake failed with fatal error SSL_ERROR_SSL:
error:1408F10B:SSL routines:ssl3_get_record:wrong version number.

To connect to Optimizer Hub using SSL, make sure the service certificate is trusted by the client server where you run Zing. This can be achieved by having the certificate signed by a publicly trusted certificate authority. If you have an internal CA trusted within the company infrastructure, make sure it is trusted.

The exact process depends on your OS distribution. Follow the instructions for your OS distribution to register the certificate on your client server. For example, on Ubuntu-based distributions you run the following command:

 sudo openssl x509 -in {path to cert.pem} -inform PEM -out /usr/local/share/ca-certificates/cert.crt
sudo update-ca-certificates

Alternatively, you can explicitly instruct Zing to use and trust a specified certificate on the filesystem by using the -XX:OptHubSSLRootsPath={path to cert.pem} flag.

If certificate validation fails, your .pem file is missing or does not match the certificate that you uploaded to Optimizer Hub, you get the following error:

 [1.856s][info][concomp] [gRPCEvent] read error!
[1.856s][info][concomp] [gRPC processing] BidiStreamWrapper is dying, finishing stream 0x7fbec00180f0 with status: failed to connect to all addresses (14)