Configuring a Cassandra cluster for internal encryption (deprecated)
This content applies only to On-premises and Client-managed cloud environments
Protect data that is transferred internally between Decision Data Store (DDS) nodes in Pega Platform by using node-to-node encryption.
Starting in Pega Platform version 8.6, the use of an internal Cassandra database is deprecated. On-premises and client-managed cloud systems that have been updated from earlier versions of Pega Platform can continue to use Cassandra in embedded mode. However, to ensure future compatibility, do not create any new environments using embedded Cassandra.
- In the
prconfig.xmlfile, enable node-to-node encryption by setting the dnode/cassandra_internode_encryption property to true.For more information about theprconfig.xmlfile, see Changing node settings by modifying the prconfig.xml file and Downloading and viewing the prconfig.xml file for a specific node. - Configure the remaining
prconfig.xmlsettings.For more information about theprconfig.xmlproperties for node-to-node encryption, see Prconfig properties for Cassandra cluster encryption. - In the
cassandra.yamlfile, add the following configuration for node-to-node encryption:server_encryption_options: { keystore_password: cassandra, require_client_auth: 'true', internode_encryption: all, truststore_password: cassandra, keystore: /path/keystore.shared, truststore: /path/truststore.shared, store_type: JKS} - Create Java keystores and truststores along with SSL certificates.For more information, see Creating Java keystores and truststores for Cassandra encryption.
Note: If you do not create separate Java keystores and truststores for external encryption, Cassandra uses the keystores and trustores that you specify for internal encryption. - Copy the
keystore.sharedandtruststore.sharedfiles to the external Cassandra directory. - In the
prconfig.xmlandcassandra.yamlfiles, update the configuration with the file paths and passwords to the certificates. - Restart Pega Platform for the changes to take effect.
Previous topic Creating Cassandra user roles with limited database access Next topic Prconfig properties for Cassandra cluster encryption