Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix pd cert allowed cn description #17397

Merged
merged 1 commit into from
Apr 30, 2024
Merged

fix pd cert allowed cn description #17397

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 9 additions & 10 deletions enable-tls-between-components.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,16 +158,17 @@ The Common Name is used for caller verification. In general, the callee needs to

To verify component caller's identity, you need to mark the certificate user identity using `Common Name` when generating the certificate, and to check the caller's identity by configuring the `Common Name` list for the callee.

> **Note:**
>
> Currently the `cert-allowed-cn` configuration item of the PD can only be set to one value. Therefore, the `commonName` of all authentication objects must be set to the same value.

- TiDB

Configure in the configuration file or command-line arguments:

```toml
[security]
cluster-verify-cn = [
"TiDB-Server",
"TiKV-Control",
]
cluster-verify-cn = ["TiDB"]
```

- TiKV
Expand All @@ -176,9 +177,7 @@ To verify component caller's identity, you need to mark the certificate user ide

```toml
[security]
cert-allowed-cn = [
"TiDB-Server", "PD-Server", "TiKV-Control", "RawKvClient1",
]
cert-allowed-cn = ["TiDB"]
```

- PD
Expand All @@ -187,7 +186,7 @@ To verify component caller's identity, you need to mark the certificate user ide

```toml
[security]
cert-allowed-cn = ["TiKV-Server", "TiDB-Server", "PD-Control"]
cert-allowed-cn = ["TiDB"]
```

- TiFlash (New in v4.0.5)
Expand All @@ -196,14 +195,14 @@ To verify component caller's identity, you need to mark the certificate user ide

```toml
[security]
cert_allowed_cn = ["TiKV-Server", "TiDB-Server"]
cert_allowed_cn = ["TiDB"]
```

Configure in the `tiflash-learner.toml` file:

```toml
[security]
cert-allowed-cn = ["PD-Server", "TiKV-Server", "TiFlash-Server"]
cert-allowed-cn = ["TiDB"]
```

## Reload certificates
Expand Down
Loading