Configure TLS

For Kubernetes-specific TLS setup, see TLS configuration for Kubernetes.

Transport Layer Security (TLS) in ADS covers three distinct concerns:

• Inbound TLS: securing the ADS server endpoints (one-way or mutual TLS).
• Outbound TLS: securing connections ADS makes to retrieve domains or call attribute connectors.
• Cluster TLS: securing intra-cluster communication for distributed caching.

One-way TLS (server presents certificate)

In one-way TLS, the client validates the server's certificate but does not present one of its own. Configure this under server.ssl in deployment.yaml.

server:
  port: 8443
  ssl:
    enabled: true
    key-store: file:server_keystore.p12
    key-store-password: ${KEYSTORE_PASSWORD}
    key-store-type: PKCS12

Property	Description
server.ssl.enabled	Set to true to enable HTTPS.
server.ssl.key-store	Path to the keystore containing the server's private key and certificate. Use the file: prefix for a file system path.
server.ssl.key-store-password	Password for the keystore. Use an environment variable.
server.ssl.key-store-type	Keystore format. Typically PKCS12.
server.ssl.client-auth	Optional. Defaults to none, which means the client is not required to present a certificate.

tip

Use environment variables for all passwords. Never store credentials as plain text in deployment.yaml.

Mutual TLS / mTLS (both sides present certificates)

Mutual TLS (mTLS) requires both the client and the server to present valid certificates. In addition to the keystore configuration above, provide a truststore containing the certificates you trust for client authentication.

server:
  port: 8443
  ssl:
    enabled: true
    key-store: file:server_keystore.p12
    key-store-password: ${KEYSTORE_PASSWORD}
    key-store-type: PKCS12
    client-auth: need
    trust-store: file:server_truststore.p12
    trust-store-password: ${TRUSTSTORE_PASSWORD}
    trust-store-type: PKCS12

Property	Description
server.ssl.client-auth	Set to need to require the client to present a certificate.
server.ssl.trust-store	Path to the truststore containing trusted client certificates.
server.ssl.trust-store-password	Password for the truststore. Use an environment variable.
server.ssl.trust-store-type	Truststore format. Typically PKCS12.

TLS options

When ADS retrieves a domain from a remote HTTPS endpoint, or communicates with an authorization server for OAuth2 tokens, you can configure TLS for those outbound connections using Spring SSL bundles. ADS supports two approaches.

• Spring TLS bundle
• JVM truststore

Configure TLS using a Spring SSL bundle

Define named SSL bundles under spring.ssl.bundle.jks and reference them by name in the domain.authentication section using tlsConfigurationId and oauth2TlsConfigurationId.

spring:
  ssl:
    bundle:
      jks:
        admBundle:
          keystore:
            location: "file:server_keystore.p12"
            password: ${KEYSTORE_PASSWORD}
            type: "PKCS12"
          truststore:
            location: "file:server_truststore.p12"
            password: ${TRUSTSTORE_PASSWORD}
            type: "PKCS12"
        tokenBundle:
          keystore:
            location: "file:keystore-token.jks"
            password: ${KEYSTORE_PASSWORD}
            type: "JKS"
          truststore:
            location: "file:truststore-token.jks"
            password: ${TRUSTSTORE_PASSWORD}
            type: "JKS"

domain:
  path: https://remote-endpoint.com/domain
  authentication:
    tlsConfigurationId: admBundle          # Used for domain retrieval
    oauth2TlsConfigurationId: tokenBundle  # Used for OAuth2 token retrieval

Bundle properties:

Property	Description
keystore.location	Path to the keystore file. Use the file: prefix for a file system path.
keystore.password	Password for the keystore.
keystore.type	Keystore format, e.g. PKCS12 or JKS.
truststore.location	Path to the truststore file.
truststore.password	Password for the truststore.
truststore.type	Truststore format, e.g. PKCS12 or JKS.

note

You can use the same bundle for both tlsConfigurationId and oauth2TlsConfigurationId, or define separate bundles if your domain endpoint and token endpoint use different certificates.

Configure TLS trust at the JVM level

As an alternative to Spring SSL bundles, configure TLS trust at the JVM level by passing truststore properties as JVM startup arguments. The JVM truststore applies globally to all outbound TLS connections made by ADS, with no changes required to deployment.yaml.

Use this approach when:

• All outbound connections from ADS trust the same certificate authority (CA).
• TLS trust is managed centrally at the container or platform level, for example through a shared corporate CA truststore injected at runtime.

Pass the following system properties when starting ADS:

-Djavax.net.ssl.trustStore=<path-to-truststore>
-Djavax.net.ssl.trustStorePassword=<password>

tip

For Kubernetes deployments, see TLS configuration for Kubernetes: JVM truststore.

note

When using JVM-level trust, tlsConfigurationId and spring.ssl.bundle.jks are not required for trust validation. Client certificate authentication (mTLS) still requires a Spring SSL bundle.

caution

Use environment variables for the truststore password rather than passing it as a plain-text argument.