Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

[ssl]

SSL/TLS certificate and validation settings.

[ssl]
certfile = /path/to/ca-cert.pem
validate = true
userkey = /path/to/client-key.pem
usercert = /path/to/client-cert.pem
version = TLSv1_2

Keys

KeyTypeDefaultDescription
certfilestringPath to the CA certificate file for server verification. Also set via SSL_CERTFILE env var.
validatebooleantrueWhether to validate the server certificate. Also set via SSL_VALIDATE env var.
userkeystringPath to the client private key (for mutual TLS).
usercertstringPath to the client certificate (for mutual TLS).
versionstringMinimum TLS version (TLSv1_2, TLSv1_3).

[certfiles] section

Map per-host certificate files:

[certfiles]
10.0.0.1 = /path/to/cert-host1.pem
10.0.0.2 = /path/to/cert-host2.pem

Enabling SSL

  1. Set --ssl on the command line, or
  2. Set factory = cqlshlib.ssl.ssl_transport_factory in [connection]

Example: mutual TLS

[connection]
factory = cqlshlib.ssl.ssl_transport_factory

[ssl]
certfile = /etc/cassandra/ssl/ca-cert.pem
userkey = /etc/cassandra/ssl/client-key.pem
usercert = /etc/cassandra/ssl/client-cert.pem
validate = true

cqlsh-rs --ssl 10.0.0.1