Configuring TLS

<raft_configuration>
           <secure>true</secure>
           <server>
               <id>1</id>
               <hostname>chnode1.marsnet.local</hostname>
               <port>9444</port>
           </server>
           <server>
               <id>2</id>
               <hostname>chnode2.marsnet.local</hostname>
               <port>9444</port>
           </server>
           <server>
               <id>3</id>
               <hostname>chnode3.marsnet.local</hostname>
               <port>9444</port>
           </server>
       </raft_configuration>
   </keeper_server>
   ```

   Note

   When ClickHouse Keeper is embedded in ClickHouse server (as shown above), Keeper uses the server's OpenSSL configuration defined in the OpenSSL section of [Configure TLS interfaces on ClickHouse nodes](#5-configure-tls-interfaces-on-clickhouse-nodes). If you run ClickHouse Keeper as a standalone process, you must add an `<openSSL>` section to the Keeper configuration file with the same CA certificate and node certificate/key settings. See [Configure OpenSSL for standalone ClickHouse Keeper](#configure-openssl-for-standalone-clickhouse-keeper) below for details.
2. Uncomment and update the keeper settings on all nodes and set the `<secure>` flag to 1:

   ```
   <zookeeper>
       <node>
           <host>chnode1.marsnet.local</host>
           <port>9281</port>
           <secure>1</secure>
       </node>
       <node>
           <host>chnode2.marsnet.local</host>
           <port>9281</port>
           <secure>1</secure>
       </node>
       <node>
           <host>chnode3.marsnet.local</host>
           <port>9281</port>
           <secure>1</secure>
       </node>
   </zookeeper>
   ```
3. Update and add the following cluster settings to `chnode1` and `chnode2`. `chnode3` will be used for the ClickHouse Keeper quorum.

   Note

   For this configuration, only one example cluster is configured. The test sample clusters must be either removed, commented out or if an existing cluster exists that is being tested, then the port must be updated and the `<secure>` option must be added. The `<user` and `<password>` must be set if the `default` user was initially configured to have a password in the installation or in the `users.xml` file.

   The following creates a cluster with one shard replica on two servers (one on each node).

   ```
   <remote_servers>
       <cluster_1S_2R>
           <shard>
               <replica>
                   <host>chnode1.marsnet.local</host>
                   <port>9440</port>
                   <user>default</user>
                   <password>ClickHouse123!</password>
                   <secure>1</secure>
               </replica>
               <replica>
                   <host>chnode2.marsnet.local</host>
                   <port>9440</port>
                   <user>default</user>
                   <password>ClickHouse123!</password>
                   <secure>1</secure>
               </replica>
           </shard>
       </cluster_1S_2R>
   </remote_servers>
   ```
4. Define macros values to be able to create a ReplicatedMergeTree table for testing. On `chnode1`:

   ```
   <macros>
       <shard>1</shard>
       <replica>replica_1</replica>
   </macros>
   ```

   On `chnode2`:

   ```
   <macros>
       <shard>1</shard>
       <replica>replica_2</replica>
   </macros>
   ```

Configure TLS interfaces on ClickHouse nodes

## Configure TLS interfaces on ClickHouse nodes[​](#5-configure-tls-interfaces-on-clickhouse-nodes "Direct link to Configure TLS interfaces on ClickHouse nodes")

The settings below are configured in the ClickHouse server `config.xml`

1. Set the display name for the deployment (optional):

   ```
   <display_name>clickhouse</display_name>
   ```
2. Set ClickHouse to listen on external ports:

   ```
   <listen_host>0.0.0.0</listen_host>
   ```
3. Configure the `https` port and disable the `http` port on each node:

   ```
   <https_port>8443</https_port>
   <!--<http_port>8123</http_port>-->
   ```
4. Configure the ClickHouse Native secure TCP port and disable the default non-secure port on each node:

   ```
   <tcp_port_secure>9440</tcp_port_secure>
   <!--<tcp_port>9000</tcp_port>-->
   ```
5. Configure the `interserver https` port and disable the default non-secure port on each node:

   ```
   <interserver_https_port>9010</interserver_https_port>
   <!--<interserver_http_port>9009</interserver_http_port>-->
   ```
6. Configure OpenSSL with certificates and paths

   Note

   Each filename and path must be updated to match the node that it is being configured on.
   For example, update the `<certificateFile>` entry to be `chnode2.crt` when configuring in `chnode2` host.

   ```
   <openSSL>
       <server>
           <certificateFile>/etc/clickhouse-server/certs/chnode1.crt</certificateFile>
           <privateKeyFile>/etc/clickhouse-server/certs/chnode1.key</privateKeyFile>
           <verificationMode>relaxed</verificationMode>
           <caConfig>/etc/clickhouse-server/certs/marsnet_ca.crt</caConfig>
           <cacheSessions>true</cacheSessions>
           <disableProtocols>sslv2,sslv3</disableProtocols>
           <preferServerCiphers>true</preferServerCiphers>
       </server>
       <client>
           <loadDefaultCAFile>false</loadDefaultCAFile>
           <caConfig>/etc/clickhouse-server/certs/marsnet_ca.crt</caConfig>
           <cacheSessions>true</cacheSessions>
           <disableProtocols>sslv2,sslv3</disableProtocols>
           <preferServerCiphers>true</preferServerCiphers>
           <verificationMode>relaxed</verificationMode>
           <invalidCertificateHandler>
               <name>RejectCertificateHandler</name>
           </invalidCertificateHandler>
       </client>
   </openSSL>
   ```

   For more information, visit <https://clickhouse.com/docs/operations/server-configuration-parameters/settings/#server_configuration_parameters-openssl>
7. Configure TLS for gRPC on every node:

   ```
   <grpc>
       <enable_ssl>1</enable_ssl>
       <ssl_cert_file>/etc/clickhouse-server/certs/chnode1.crt</ssl_cert_file>
       <ssl_key_file>/etc/clickhouse-server/certs/chnode1.key</ssl_key_file>
       <ssl_require_client_auth>true</ssl_require_client_auth>
       <ssl_ca_cert_file>/etc/clickhouse-server/certs/marsnet_ca.crt</ssl_ca_cert_file>
       <transport_compression_type>none</transport_compression_type>
       <transport_compression_level>0</transport_compression_level>
       <max_send_message_size>-1</max_send_message_size>
       <max_receive_message_size>-1</max_receive_message_size>
       <verbose_logs>false</verbose_logs>
   </grpc>
   ```

   For more information, visit <https://clickhouse.com/docs/interfaces/grpc/>
8. Configure ClickHouse client on at least one of the nodes to use TLS for connections in its own `config.xml` file (by default in `/etc/clickhouse-client/`):

   ```
   <openSSL>
       <client>
           <loadDefaultCAFile>false</loadDefaultCAFile>
           <caConfig>/etc/clickhouse-server/certs/marsnet_ca.crt</caConfig>
           <cacheSessions>true</cacheSessions>
           <disableProtocols>sslv2,sslv3</disableProtocols>
           <preferServerCiphers>true</preferServerCiphers>
           <invalidCertificateHandler>
               <name>RejectCertificateHandler</name>
           </invalidCertificateHandler>
       </client>
   </openSSL>
   ```
9. Disable default emulation ports for MySQL and PostgreSQL:

   ```
   <!--mysql_port>9004</mysql_port-->
   <!--postgresql_port>9005</postgresql_port-->
   ```

Testing

## Testing[​](#6-testing "Direct link to Testing")

1. Start all nodes, one at a time:

   ```
   service clickhouse-server start
   ```
2. Verify secure ports are up and listening, should look similar to this example on each node:

   ```
   root@chnode1:/etc/clickhouse-server# netstat -ano | grep tcp
   ```