Microservices Engine:Enable TLS for MSE Nacos instances

Prerequisites

• or Activate MSE.

• A Nacos engine of version 2.1.2.1 or later is created. Create a Nacos engine. To upgrade an earlier version, see Upgrade a Nacos engine version.

• The Java Development Kit (JDK) version is 8u252 or later.

  Note

  JDK versions earlier than 8u252 have TLS compatibility issues. Upgrade to 8u252 or later, or use a pure nacos-client instead. How do I import a pure nacos-client?.

  • A pure nacos-client can use OpenSSL as the SSL provider, but you must remove the nacos.remote.client.rpc.tls.provider parameter.

  • Pure Nacos versions do not shade dependent second-party packages. You may need to resolve package conflicts.

Step 1: Modify Nacos parameter settings

1. Log on to the MSE console, and select a region in the top navigation bar.

2. In the left-side navigation pane, choose Microservices Registry > Instances. Click the name of the instance.

3. In the navigation pane on the left, click Parameter Settings. Click Edit, set the TLSEnabled parameter to Yes, and then click Save and Restart Instance.

   After the restart, the server accepts TLS connections from Nacos clients.

Step 2: Upgrade the nacos-client

1. Upgrade the nacos-client to version 2.2.1 or later.

   <dependency>
       <groupId>com.alibaba.nacos</groupId>
       <artifactId>nacos-client</artifactId>
       <version>2.2.1</version>
   </dependency>

2. Set the tls parameters to enable the TLS feature.

   Set tls parameters using one of the following methods. Priority: properties file > JVM parameters > environment variables.

   • Set parameters in a properties file. Pass them when building NacosConfigService or NacosNamingService instances.

     • properties.put("nacos.remote.client.rpc.tls.enable","true");

     • properties.put("nacos.remote.client.rpc.tls.trustAll","true");

     • properties.put("nacos.remote.client.rpc.tls.provider","JDK");

     This method takes precedence over JVM parameters and environment variables. It applies at the NacosConfigService and NacosNamingService instance level.

   • Set JVM parameters.

     • -Dnacos.remote.client.rpc.tls.enable=true

     • -Dnacos.remote.client.rpc.tls.trustAll=true

     • -Dnacos.remote.client.rpc.tls.provider=JDK

     This method applies at the JVM process level to all NacosConfigService and NacosNamingService instances without properties-file overrides.

   • Set environment variables.

     • nacos_remote_client_rpc_tls_enable=true

     • nacos_remote_client_rpc_tls_trustAll=true

     • nacos_remote_client_rpc_tls_provider=JDK

     This method applies at the server level to all instances without JVM or properties-file overrides.

3. Confirm that TLS encryption is enabled.

   1. View the startup logs.

      The nacos-client logs TLS configuration to {user.home}/logs/nacos/remote.log at startup.

      2023-04-06 09:56:56.539 INFO [com.alibaba.nacos.client.Worker:c.a.n.c.r.c.g.GrpcClient] grpc client connection server:mse-xxx.nacos-ans.mse.aliyuncs.com ip,serverPort:9848,grpcTslConfig:{"sslProvider":"","enableTls":true,"mutualAuthEnable":false,"trustAll":true}

      The "enableTls":true field confirms that TLS is active. If the client starts and reads/writes configurations normally, encryption is working.

   2. Capture data packets with the tcpdump command.

      Run tcpdump to capture packets. The following example saves output to /tmp/tcptrace.cap. Adjust the path as needed.

      sudo tcpdump -i any -w /tmp/tcptrace.cap -p 9848

      Open the file in Wireshark or a similar tool. If the protocol shows TCP&TLS, encryption is active.

FAQ

<dependency>
    <groupId>com.alibaba.nacos</groupId>
    <artifactId>nacos-client</artifactId>
    <version>2.2.1</version>
    <classifier>pure</classifier>
</dependency>
<dependency>
    <groupId>com.alibaba.nacos</groupId>
    <artifactId>nacos-common</artifactId>
    <version>2.2.1</version>
</dependency>
<dependency>
    <groupId>com.alibaba.nacos</groupId>
    <artifactId>nacos-api</artifactId>
    <version>2.2.1</version>
</dependency>