Skip to content

Commit af277a6

Browse files
committed
ZOOKEEPER-5023: Additional documentation for AdminServer TLS ciphers and protocols
1 parent 4ed0139 commit af277a6

1 file changed

Lines changed: 21 additions & 0 deletions

File tree

zookeeper-docs/src/main/resources/markdown/zookeeperAdmin.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2686,6 +2686,27 @@ ssl.quorum.trustStore.password=password
26862686
2019-08-03 15:44:55,403 [myid:] - INFO [main:JettyAdminServer@170] - Started AdminServer on address 0.0.0.0, port 8080 and command URL /commands
26872687
```
26882688

2689+
###### Restrict TLS protocols and cipher suites for SSL/TLS negotiation in AdminServer
2690+
2691+
From 3.10.0 AdminServer uses the following properties:
2692+
2693+
* **ssl.quorum.enabledProtocols** to specify the enabled protocols,
2694+
* **ssl.quorum.ciphersuites** to specify the enabled cipher suites.
2695+
2696+
Add the following configuration settings to the `zoo.cfg` config file:
2697+
2698+
```
2699+
ssl.quorum.enabledProtocols=TLSv1.2,TLSv1.3
2700+
ssl.quorum.ciphersuites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
2701+
```
2702+
2703+
Verify that the following entries in the logs can be seen:
2704+
2705+
```
2706+
2026-03-11 11:38:01,102 [myid:] - INFO [main:o.a.z.s.a.JettyAdminServer@159] - Setting enabled protocols: 'TLSv1.2,TLSv1.3'
2707+
2026-03-11 11:38:01,102 [myid:] - INFO [main:o.a.z.s.a.JettyAdminServer@166] - Setting enabled cipherSuites: 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384'
2708+
```
2709+
26892710
Available commands include:
26902711

26912712
* *connection_stat_reset/crst*:

0 commit comments

Comments
 (0)