github.com/maier/nomad@v0.4.1-0.20161110003312-a9e3d0b8549d/website/source/docs/agent/encryption.html.md (about)

     1  ---
     2  layout: "docs"
     3  page_title: "Gossip and RPC Encryption"
     4  sidebar_current: "docs-agent-encryption"
     5  description: |-
     6    Learn how to configure Nomad to encrypt both its gossip traffic and its RPC
     7    traffic.
     8  ---
     9  
    10  # Encryption
    11  
    12  The Nomad agent supports encrypting all of its network traffic. There are
    13  two separate encryption systems, one for gossip traffic, and one for RPC.
    14  
    15  ## Gossip
    16  
    17  Enabling gossip encryption only requires that you set an encryption key when
    18  starting the Nomad server. The key can be set via the
    19  [`encrypt`](/docs/agent/configuration/server.html#encrypt) parameter: the value
    20  of this setting is a server configuration file containing the encryption key.
    21  
    22  The key must be 16-bytes, base64 encoded. As a convenience, Nomad provides the
    23  [`nomad keygen`](/docs/commands/keygen.html) command to generate a cryptographically suitable key:
    24  
    25  ```shell
    26  $ nomad keygen
    27  cg8StVXbQJ0gPvMd9o7yrg==
    28  ```
    29  
    30  With that key, you can enable gossip encryption on the agent.
    31  
    32  
    33  ## RPC and Raft Encryption with TLS
    34  
    35  Nomad supports using TLS to verify the authenticity of servers and clients. To
    36  enable this, Nomad requires that all clients and servers have key pairs that are
    37  generated and signed by a Certificate Authority. This can be a private CA.
    38  
    39  TLS can be used to verify the authenticity of the servers and clients. The
    40  configuration option [`verify_server_hostname`][tls] causes Nomad to verify that
    41  a certificate is provided that is signed by the Certificate Authority from the
    42  [`ca_file`][tls] for TLS connections.
    43  
    44  If `verify_server_hostname` is set, then outgoing connections perform
    45  hostname verification. All servers must have a certificate valid for
    46  `server.<region>.nomad` or the client will reject the handshake. It is also
    47  recommended for the certificate to sign `localhost` such that the CLI can
    48  validate the server name.
    49  
    50  TLS is used to secure the RPC calls between agents, but gossip between nodes is
    51  done over UDP and is secured using a symmetric key. See above for enabling
    52  gossip encryption.
    53  
    54  [tls]: /docs/agent/configuration/tls.html "Nomad TLS Configuration"