Authentication


If you require LDAP authentication, it is necessary, in order to connect to the DSE nodes via a secure connection, to select the SSL type.  There are 2 ways to leverage the Java Keystore (JKS): accessing the JKS directly, or using certificates issued from the keystore.


1) Accessing the keystore directly

Specify the path and filename to keystore, the access password, and the alias name for the Cassandra instance.



The Alias Name is mandatory.  If you don't know it, it can be found out by the following command:


keytool -v -list -keystore <jks file>


The alias can be found in the section “Alias name”.  If no alias was set, you should use the default "mykey".



If necessary, you may also declare truststore parameters:



You may consult this page for more info, as well as the full keytool specification.


The system assumes that users have installed Java JDK from here, and that the JAVA_HOME variable points at the folder where java was installed. It is recommended to use Java 8.


Our module for decrypting JKS uses the following logic to find java home:

  1. check for JAVA_HOME
  2. on Windows, query the Registry
  3. If neither of the previous methods worked, then scan the PATH for javac
  4. On mac, the parent directory of javac is checked for a java_home binary. If that binary exists then it is executed and the result is used
  5. The grandparent directory of javac is used. This is similar to $(dirname $(dirname $(readlink $(which javac))))


2) Convert the keystore and truststore into PEM keys


Assuming cassandra server config (cassandra.yaml):


client_encryption_options:

  enabled: true

  keystore: keystore.jks

  keystore_password: *******

  truststore: truststore.jks

  truststore_password: ******

  require_client_auth: true


  1. Install java if you don't have it: https://www.java.com/en/download/
  2. Install openssl: https://wiki.openssl.org/index.php/Binaries
    1. Linux: sudo apt-get install openssl
    2. MacOS: brew install openssl
    3. Windows: https://slproweb.com/products/Win32OpenSSL.html
  3. Find out alias used by keystore

Run the following command to find out what alias is used by keystore:

> keytool -v -list -keystore keystore.jks

where keystore.jks is the java key store file granting access to the cassandra instance

alias will be in the section “Alias name”

  1. Generate PKS key

> keytool -importkeystore -srckeystore keystore.jks -destkeystore myapp.p12 -srcalias myapp-dev -srcstoretype jks -deststoretype pkcs12

keystore.jks - the java key store file granting access to the cassandra instance

myapp.p12 - intermediate PKS key

myapp-dev - alias used by keystore and determined in step 3 above

      5. Generate CA key

> keytool -importkeystore -srckeystore truststore.jks -destkeystore trust.p12 -srcalias myapp-dev -srcstoretype jks -deststoretype pkcs12

      6. Generate .pem key

> openssl pkcs12 -in myapp.p12 -nokeys -out myapp.pem

> openssl pkcs12 -in trust.p12 -nokeys -out ca.pem

> openssl pkcs12 -in myapp.p12 -nodes -nocerts -out myapp.key


      7. Use generated files in Hackolade:

“Certificate Authority”: ca.pem

“Client Certificate”: myapp.pem

“Client Private Key”: myapp.key