You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The file /var/lib/glusterd/secure-access may or may not contain a line with the transport.socket.ssl-cert-depth option.
The Guide is missing something like the following:
Creating an empty file is enough to enable TLS encryption of the management traffic.
By specifying 'option transport.socket.ssl-cert-depth X' inside that file you can influence the verification of TLS certificates:
- a value of '0' means ...
- a value of '1' (which is the default) means that '/etc/ssl/glusterfs.ca' contains a list of TLS certificates that are to be allowed
- a value of '2' means that '/etc/ssl/glusterfs.ca' contains a CA certificate, and all TLS certificates that are signed by this CA are to be allowed
- a value of '3' means that '/etc/ssl/glusterfs.ca' contains a CA certificate, and all TLS certificates that are signed by this CA's intermediae CA are to be allowed
...
I am fishy on the exact details, as there does not seem to be a comprehensive list of the values in the docs. When using an empty file, the value seems to default to 1 according to the output on one of our servers.
Edit:
It would make sense to point out that apparently (at least in our tests) an empty file is enough for a client, but the server needs the right setting, otherwise clients may not be allowed to mount...
The text was updated successfully, but these errors were encountered:
glusterdocs/docs/Administrator-Guide/SSL.md
Line 166 in 78bfdf9
The file
/var/lib/glusterd/secure-access
may or may not contain a line with thetransport.socket.ssl-cert-depth
option.The Guide is missing something like the following:
I am fishy on the exact details, as there does not seem to be a comprehensive list of the values in the docs. When using an empty file, the value seems to default to
1
according to the output on one of our servers.Edit:
It would make sense to point out that apparently (at least in our tests) an empty file is enough for a client, but the server needs the right setting, otherwise clients may not be allowed to mount...
The text was updated successfully, but these errors were encountered: