Microservices Engine:Enable TLS for MSE Nacos instances

Prerequisites

• Microservices Engine (MSE) is activated. For more information, see Activate MSE.

• The Nacos engine in version 2.1.2.1 or later is created. For more information, see Create a Nacos engine. If the engine version is earlier than 2.1.2.1, upgrade the engine version to 2.1.2.1 or later. For more information about how to upgrade an engine version, see Update a Nacos version.

• The Java Development Kit (JDK) version is 8u252 or later.

  Note

  JDKs of versions earlier than 8u252 are incompatible with TLS. Therefore, you must upgrade such JDKs to 8u252 or later. If the JDK versions cannot be upgraded, you can use Nacos clients that are not bundled with JDKs. For more information, see How do I use Nacos clients unbundled with JDKs? in this topic.

  • If Nacos clients are not bundled with JDKs, you can use OpenSSL as the SSL provider. In this case, you must remove the nacos.remote.client.rpc.tls.provider parameter.

  • For Nacos clients that are not bundled with JDKs, the required second-party packages are not shaded. Therefore, you may need to resolve package conflicts.

Step 1: Modify Nacos parameters

1. Log on to the MSE console, and select a region in the top navigation bar.

2. In the left-side navigation pane, choose Microservices Registry > Instances. Click the name of the instance.

3. In the left-side navigation pane, click Parameter Settings. On the page that appears, click Edit, set the TLSEnabled parameter to Yes, and then click Save and Restart Instance.

   After you restart the Nacos instance, the server can support the TLS-enabled Nacos client.

Step 2: Upgrade the Nacos client

1. Upgrade the version of the Nacos client to 2.2.3. Sample code:

   <dependency>
       <groupId>com.alibaba.nacos</groupId>
       <artifactId>nacos-client</artifactId>
       <version>2.2.3</version>
   </dependency>

2. Configure TLS-related parameters to enable TLS.

   You can configure TLS-related parameters by using the following methods in order of precedence: .properties files > JVM parameters > environment variables. You can select a method based on your business requirements.

   • Use .properties files. When you create a NacosConfigService or NacosNamingService, specify TLS-related parameters in the .properties file.

     • properties.put("nacos.remote.client.rpc.tls.enable","true");

     • properties.put("nacos.remote.client.rpc.tls.trustAll","true");

     • properties.put("nacos.remote.client.rpc.tls.provider","JDK");

     This method takes precedence over the methods of configuring JVM parameters and environment variables. You can use this method to configure TLS-related parameters for NacosConfigService and NacosNamingService.

   • Configure JVM parameters.

     • -Dnacos.remote.client.rpc.tls.enable=true

     • -Dnacos.remote.client.rpc.tls.trustAll=true

     • -Dnacos.remote.client.rpc.tls.provider=JDK

     This method is used at the Java virtual machine (JVM) process level. In a JVM process, TLS-related JVM parameters take effect for NacosConfigService and NacosNamingService for which TLS-related parameters are not specified in the .properties file.

   • Configure environment variables.

     • nacos_remote_client_rpc_tls_enable=true

     • nacos_remote_client_rpc_tls_trustAll=true

     • nacos_remote_client_rpc_tls_provider=JDK

     This method is used at the server level. The TLS-related parameters that are not specified in JVM parameters or the .properties file take effect.

3. Confirm that TLS is enabled.

   1. View the startup logs of the Nacos client.

      When the Nacos client starts, configuration parameters are listed in the remote.log file in the {user.home}/logs/nacos/ directory.

      2023-04-06 09:56:56.539 INFO [com.alibaba.nacos.client.Worker:c.a.n.c.r.c.g.GrpcClient] grpc client connection server:mse-xxx.nacos-ans.mse.aliyuncs.com ip,serverPort:9848,grpcTslConfig:{"sslProvider":"","enableTls":true,"mutualAuthEnable":false,"trustAll":true}

      "enableTls":true indicates that TLS is enabled. If the client successfully starts and NacosConfigService reads and writes data as expected, TLS is enabled for data communications.

   2. Run the tcpdump command to capture packets.

      You can run the tcpdump command to capture packets and specify the directory in which the output file is stored in the command. For example, if you run the following tcpdump command, the captured content is stored in the tcptrace.cap file in the /tmp/ directory. You can customize the file name and directory.

      sudo tcpdump -i any -w /tmp/tcptrace.cap -p 9848

      Use a packet analytics tool such as Wireshark to parse the preceding file. If captured packets are TCP/TLS packets, TLS is enabled.

FAQ

<dependency>
    <groupId>com.alibaba.nacos</groupId>
    <artifactId>nacos-client</artifactId>
    <version>2.2.3</version>
    <classifier>pure</classifier>
</dependency>
<dependency>
    <groupId>com.alibaba.nacos</groupId>
    <artifactId>nacos-common</artifactId>
    <version>2.2.3</version>
</dependency>
<dependency>
    <groupId>com.alibaba.nacos</groupId>
    <artifactId>nacos-api</artifactId>
    <version>2.2.3</version>
</dependency>