Support Transport Layer Security (TLS)

Transport Layer Security (TLS) is a very common security way when transport data through Internet. In some use cases, end users report the background:

Target(under monitoring) applications are in a region, which also named VPC, at the same time, the SkyWalking backend is in another region (VPC).

Because of that, security requirement is very obvious.

Creating SSL/TLS Certificates

The first step is to generate certificates and key files for encrypting communication. This is fairly straightforward: use openssl from the command line.

Use this script if you are not familiar with how to generate key files.

We need the following files:

client.pem: A private RSA key to sign and authenticate the public key. It’s either a PKCS#8(PEM) or PKCS#1(DER).
client.crt: Self-signed X.509 public keys for distribution.
ca.crt: A certificate authority public key for a client to validate the server’s certificate.

Authentication Mode

Find ca.crt, and use it at client side. In mTLS mode, client.crt and client.pem are required at client side.
Find server.crt, server.pem and ca.crt. Use them at server side. Please refer to gRPC Security of the OAP server doc for more details.

Open and config TLS

Agent config

Agent enables TLS automatically after the ca.crt(by default /ca folder in agent package) file is detected.
TLS with no CA mode could be activated by this setting.

agent.force_tls=${SW_AGENT_FORCE_TLS:true}

Enable mutual TLS

Sharing gRPC server must be started with mTLS enabled. More details can be found in receiver-sharing-server section in application.yaml. Please refer to gRPC Security and gRPC/HTTP server for receiver.
Copy CA certificate, certificate and private key of client into agent/ca.
Configure client-side SSL/TLS in agent.conf.
Change SW_AGENT_COLLECTOR_BACKEND_SERVICES targeting to host and port of receiver-sharing-server.

For example:

agent.force_tls=${SW_AGENT_FORCE_TLS:true}
agent.ssl_trusted_ca_path=${SW_AGENT_SSL_TRUSTED_CA_PATH:/ca/ca.crt}
agent.ssl_key_path=${SW_AGENT_SSL_KEY_PATH:/ca/client.pem}
agent.ssl_cert_chain_path=${SW_AGENT_SSL_CERT_CHAIN_PATH:/ca/client.crt}

collector.backend_service=${SW_AGENT_COLLECTOR_BACKEND_SERVICES:skywalking-oap:11801}

Notice, the client-side’s certificate and the private key are from the same CA certificate with server-side.

Edit this page