Skip to main content


         This documentation site is for previous versions. Visit our new documentation site for current releases.      
 

Configuring a Cassandra cluster for external encryption

Updated on July 5, 2022

This content applies only to On-premises and Client-managed cloud environments

Establish a secure channel for data transfers between Pega client machines and a Cassandra cluster by using client-to-server encryption.

Note: The following node types require client-to-server encryption:
  • Decision Data Store (DDS) nodes
  • Adaptive Decision Manager (ADM) nodes
  • Visual Business Director (VBD) nodes
  • Data flow nodes
  • App tier nodes
  • Decision Hub tier nodes
  1. In the prconfig.xml file, enable node-to-node encryption by setting the dnode/cassandra_client_encryption property to true.
    If you enable client-to-server encryption without updating the settings, the values of the corresponding node-to-node encryption properties are used for the missing client settings. In that case, configure node-to-node encryption regardless for all nodes, not only DDS. For more information, see Configuring a Cassandra cluster for internal encryption.
  2. Configure the remaining prconfig.xml settings.
    For more information about the prconfig.xml properties for client-to-server encryption, see Prconfig properties for Cassandra cluster encryption.
  3. In the cassandra.yaml file, add the following configuration:
    • For client-to-server encryption, add:
      client_encryption_options: {
      keystore_password: cassandra,
      require_client_auth: 'true',
      truststore_password: cassandra,
      keystore: /path/keystore.shared,
      truststore: /path/truststore.shared,
      store_type: JKS,
      enabled: 'true',
      algorithm: SunX509}
    • For Cassandra node-to-node encryption, add:
      server_encryption_options: {
      keystore_password: cassandra,
      require_client_auth: 'true',
      internode_encryption: all,
      truststore_password: cassandra,
      keystore: /path/keystore.shared,
      truststore: /path/truststore.shared,
      store_type: JKS}
  4. Create Java keystores and truststores along with SSL certificates.
    For more information, see Creating Java keystores and truststores for Cassandra encryption.
    Note: If you do not create separate Java keystores and truststores for external encryption, Cassandra uses the keystores and trustores that you specified for internal encryption.
  5. Copy the keystore.shared and truststore.shared files to the external Cassandra directory.
  6. In the prconfig.xml and cassandra.yaml files, update the configuration with the file paths and passwords to the certificates.
  7. Restart Pega Platform for the changes to take effect.
  • Previous topic Creating Java keystores and truststores for Cassandra encryption
  • Next topic Prconfig properties for Cassandra cluster encryption

Have a question? Get answers now.

Visit the Support Center to ask questions, engage in discussions, share ideas, and help others.

Did you find this content helpful?

Want to help us improve this content?

We'd prefer it if you saw us at our best.

Pega.com is not optimized for Internet Explorer. For the optimal experience, please use:

Close Deprecation Notice
Contact us