TLS Encryption and Transport Security

Transport Layer Security (TLS) provides encryption for all data transmitted between Geode clients and servers. Geode exclusively uses TLS 1.3, the most secure version of the TLS protocol, integrated with the QUIC transport protocol for optimal performance and security. This combination delivers encrypted, authenticated, and integrity-protected communications with minimal latency. <h3 id="tls-13-overview" class="position-relative d-flex align-items-center group"> TLS 1.3 Overview <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="tls-13-overview" aria-haspopup="dialog" aria-label="Share link: TLS 1.3 Overview"> Share link </button> </h3><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>TLS 1.3 offers significant improvements over earlier versions: <ul> <li>Faster Handshakes: 1-RTT handshakes (0-RTT for resumption)</li> <li>Stronger Cryptography: Only modern, secure cipher suites</li> <li>Forward Secrecy: All cipher suites provide forward secrecy</li> <li>Reduced Attack Surface: Removed legacy features and algorithms</li> <li>Simplified Protocol: Cleaner, more auditable implementation</li> </ul> <h4 id="quic--tls-integration" class="position-relative d-flex align-items-center group"> QUIC + TLS Integration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="quic--tls-integration" aria-haspopup="dialog" aria-label="Share link: QUIC &#43; TLS Integration"> Share link </button> </h4>Geode uses QUIC as its transport protocol, which integrates TLS 1.3 directly: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">Client Server | | |--- QUIC Initial (Client Hello) --------->| | | |<-- QUIC Handshake (Server Hello) --------| |<-- Certificate, Finished ----------------| | | |--- Finished ----------------------------->| | | |<======= Encrypted Application Data ======>| </code></pre></div>Benefits of QUIC + TLS: <ul> <li>Single round-trip connection establishment</li> <li>Encrypted transport from the first packet</li> <li>Multiplexed streams without head-of-line blocking</li> <li>Connection migration between networks</li> <li>Built-in congestion control</li> </ul> <h3 id="server-tls-configuration" class="position-relative d-flex align-items-center group"> Server TLS Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="server-tls-configuration" aria-haspopup="dialog" aria-label="Share link: Server TLS Configuration"> Share link </button> </h3> <h4 id="basic-configuration" class="position-relative d-flex align-items-center group"> Basic Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="basic-configuration" aria-haspopup="dialog" aria-label="Share link: Basic Configuration"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Minimal TLS configuration geode serve --tls-cert=/etc/geode/certs/server.crt \ --tls-key=/etc/geode/certs/server.key # With certificate chain geode serve --tls-cert=/etc/geode/certs/server-chain.crt \ --tls-key=/etc/geode/certs/server.key \ --tls-ca=/etc/geode/certs/ca.crt </code></pre></div> <h4 id="configuration-file" class="position-relative d-flex align-items-center group"> Configuration File <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="configuration-file" aria-haspopup="dialog" aria-label="Share link: Configuration File"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml server: listen: "0.0.0.0:3141" tls: enabled: true cert_file: "/etc/geode/certs/server.crt" key_file: "/etc/geode/certs/server.key" ca_file: "/etc/geode/certs/ca.crt" # TLS 1.3 is the only supported version min_version: "1.3" max_version: "1.3" # Cipher suite preferences (TLS 1.3 suites only) cipher_suites: - TLS_AES_256_GCM_SHA384 - TLS_CHACHA20_POLY1305_SHA256 - TLS_AES_128_GCM_SHA256 # Certificate verification verify_client: false verify_server: true </code></pre></div> <h4 id="cipher-suites" class="position-relative d-flex align-items-center group"> Cipher Suites <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="cipher-suites" aria-haspopup="dialog" aria-label="Share link: Cipher Suites"> Share link </button> </h4>Geode supports the following TLS 1.3 cipher suites: <table> <thead> <tr> <th>Cipher Suite</th> <th>Description</th> <th>Recommendation</th> </tr> </thead> <tbody> <tr> <td>TLS_AES_256_GCM_SHA384</td> <td>AES-256 with GCM mode</td> <td>Preferred for high security</td> </tr> <tr> <td>TLS_CHACHA20_POLY1305_SHA256</td> <td>ChaCha20-Poly1305</td> <td>Preferred for mobile/ARM</td> </tr> <tr> <td>TLS_AES_128_GCM_SHA256</td> <td>AES-128 with GCM mode</td> <td>Good balance of security/performance</td> </tr> </tbody> </table> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Specify cipher suite order geode serve --tls-cipher-suites=TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256 </code></pre></div> <h3 id="certificate-management" class="position-relative d-flex align-items-center group"> Certificate Management <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="certificate-management" aria-haspopup="dialog" aria-label="Share link: Certificate Management"> Share link </button> </h3> <h4 id="generating-certificates" class="position-relative d-flex align-items-center group"> Generating Certificates <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="generating-certificates" aria-haspopup="dialog" aria-label="Share link: Generating Certificates"> Share link </button> </h4> <h5 id="self-signed-certificates-development" class="position-relative d-flex align-items-center group"> Self-Signed Certificates (Development) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="self-signed-certificates-development" aria-haspopup="dialog" aria-label="Share link: Self-Signed Certificates (Development)"> Share link </button> </h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Generate CA certificate openssl genrsa -out ca.key 4096 openssl req -new -x509 -days 3650 -key ca.key \ -out ca.crt \ -subj "/CN=Geode Development CA/O=Development" # Generate server certificate openssl genrsa -out server.key 4096 openssl req -new -key server.key \ -out server.csr \ -subj "/CN=geode.local/O=Development" # Sign server certificate openssl x509 -req -days 365 \ -in server.csr \ -CA ca.crt -CAkey ca.key \ -CAcreateserial \ -out server.crt \ -extfile <(printf "subjectAltName=DNS:geode.local,DNS:localhost,IP:127.0.0.1") </code></pre></div> <h5 id="using-geodes-certificate-generator" class="position-relative d-flex align-items-center group"> Using Geode&rsquo;s Certificate Generator <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="using-geodes-certificate-generator" aria-haspopup="dialog" aria-label="Share link: Using Geodes Certificate Generator"> Share link </button> </h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Generate self-signed certificate geode cert-gen --output-dir=/etc/geode/certs \ --common-name=geode.example.com \ --san=DNS:geode.example.com,DNS:localhost,IP:127.0.0.1 \ --validity-days=365 # Generate CA and server certificates geode cert-gen --mode=ca \ --output-dir=/etc/geode/certs \ --common-name="Geode Internal CA" geode cert-gen --mode=server \ --output-dir=/etc/geode/certs \ --ca-cert=/etc/geode/certs/ca.crt \ --ca-key=/etc/geode/certs/ca.key \ --common-name=geode.example.com \ --san=DNS:geode.example.com,DNS:*.geode.example.com </code></pre></div> <h5 id="certificate-signing-request-production" class="position-relative d-flex align-items-center group"> Certificate Signing Request (Production) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="certificate-signing-request-production" aria-haspopup="dialog" aria-label="Share link: Certificate Signing Request (Production)"> Share link </button> </h5><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Generate CSR for external CA geode cert-gen --csr-only \ --output=/etc/geode/certs/geode.csr \ --key-output=/etc/geode/certs/geode.key \ --common-name=geode.production.example.com \ --san=DNS:geode.production.example.com \ --organization="Example Corp" \ --country=US # Submit CSR to your CA, receive signed certificate # Place signed certificate as server.crt </code></pre></div> <h4 id="certificate-chain-configuration" class="position-relative d-flex align-items-center group"> Certificate Chain Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="certificate-chain-configuration" aria-haspopup="dialog" aria-label="Share link: Certificate Chain Configuration"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Concatenate certificates in order: server, intermediate, root cat server.crt intermediate.crt root.crt > server-chain.crt # Configure Geode with chain geode serve --tls-cert=/etc/geode/certs/server-chain.crt \ --tls-key=/etc/geode/certs/server.key </code></pre></div> <h4 id="certificate-rotation" class="position-relative d-flex align-items-center group"> Certificate Rotation <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="certificate-rotation" aria-haspopup="dialog" aria-label="Share link: Certificate Rotation"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Hot reload certificates without restart geode cert-rotate --new-cert=/etc/geode/certs/new-server.crt \ --new-key=/etc/geode/certs/new-server.key \ --graceful=true \ --overlap-duration=1h # Verify rotation geode tls-status # Output: # Current Certificate: /etc/geode/certs/new-server.crt # Valid Until: 2027-01-28T00:00:00Z # Cipher: TLS_AES_256_GCM_SHA384 </code></pre></div> <h4 id="automatic-certificate-renewal-acmelets-encrypt" class="position-relative d-flex align-items-center group"> Automatic Certificate Renewal (ACME/Let&rsquo;s Encrypt) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="automatic-certificate-renewal-acmelets-encrypt" aria-haspopup="dialog" aria-label="Share link: Automatic Certificate Renewal (ACME/Lets Encrypt)"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml tls: acme: enabled: true email: [email protected] domains: - geode.example.com directory_url: https://acme-v02.api.letsencrypt.org/directory storage_path: /etc/geode/acme renewal_days_before: 30 </code></pre></div> <h3 id="mutual-tls-mtls" class="position-relative d-flex align-items-center group"> Mutual TLS (mTLS) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="mutual-tls-mtls" aria-haspopup="dialog" aria-label="Share link: Mutual TLS (mTLS)"> Share link </button> </h3>Mutual TLS requires clients to present certificates for authentication, providing strong machine-to-machine authentication. <h4 id="server-configuration-for-mtls" class="position-relative d-flex align-items-center group"> Server Configuration for mTLS <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="server-configuration-for-mtls" aria-haspopup="dialog" aria-label="Share link: Server Configuration for mTLS"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Require client certificates geode serve --tls-cert=/etc/geode/certs/server.crt \ --tls-key=/etc/geode/certs/server.key \ --tls-client-ca=/etc/geode/certs/client-ca.crt \ --require-client-certificates=true \ --verify-client-certificates=true </code></pre></div> <h4 id="configuration-file-1" class="position-relative d-flex align-items-center group"> Configuration File <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="configuration-file-1" aria-haspopup="dialog" aria-label="Share link: Configuration File"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml tls: enabled: true cert_file: "/etc/geode/certs/server.crt" key_file: "/etc/geode/certs/server.key" client_auth: enabled: true required: true ca_file: "/etc/geode/certs/client-ca.crt" verify: true # Optional: Certificate pinning allowed_certs: - "/etc/geode/certs/allowed/app1.crt" - "/etc/geode/certs/allowed/app2.crt" # Optional: Subject name requirements allowed_subjects: - "CN=app-service,O=Example Corp" - "CN=etl-service,O=Example Corp" </code></pre></div> <h4 id="generating-client-certificates" class="position-relative d-flex align-items-center group"> Generating Client Certificates <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="generating-client-certificates" aria-haspopup="dialog" aria-label="Share link: Generating Client Certificates"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Generate client key openssl genrsa -out client.key 4096 # Generate CSR openssl req -new -key client.key \ -out client.csr \ -subj "/CN=app-service/O=Example Corp" # Sign with client CA openssl x509 -req -days 365 \ -in client.csr \ -CA client-ca.crt -CAkey client-ca.key \ -CAcreateserial \ -out client.crt </code></pre></div> <h4 id="client-connection-with-certificate" class="position-relative d-flex align-items-center group"> Client Connection with Certificate <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="client-connection-with-certificate" aria-haspopup="dialog" aria-label="Share link: Client Connection with Certificate"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Shell connection with client certificate geode shell --host=geode.example.com:3141 \ --tls-cert=/path/to/client.crt \ --tls-key=/path/to/client.key \ --tls-ca=/path/to/ca.crt </code></pre></div> <h4 id="client-library-configuration" class="position-relative d-flex align-items-center group"> Client Library Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="client-library-configuration" aria-haspopup="dialog" aria-label="Share link: Client Library Configuration"> Share link </button> </h4>Go Client: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-go" data-lang="go">import ( "crypto/tls" "geodedb.com/geode" ) // Load client certificate cert, err := tls.LoadX509KeyPair("client.crt", "client.key") if err != nil { log.Fatal(err) } // Load CA certificate caCert, err := os.ReadFile("ca.crt") if err != nil { log.Fatal(err) } caCertPool := x509.NewCertPool() caCertPool.AppendCertsFromPEM(caCert) // Configure client config := &geode.Config{ Host: "geode.example.com:3141", TLS: &geode.TLSConfig{ Certificates: []tls.Certificate{cert}, RootCAs: caCertPool, }, } client, err := geode.NewClient(config) </code></pre></div>Python Client: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">from geode_client import Client, TLSConfig tls_config = TLSConfig( cert_file="/path/to/client.crt", key_file="/path/to/client.key", ca_file="/path/to/ca.crt", verify=True ) client = Client( host="geode.example.com", port=3141, tls=tls_config ) </code></pre></div>Rust Client: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-rust" data-lang="rust">use geode_client::{Client, TlsConfig}; use std::path::PathBuf; let tls_config = TlsConfig::new() .with_cert(PathBuf::from("client.crt")) .with_key(PathBuf::from("client.key")) .with_ca(PathBuf::from("ca.crt")); let client = Client::builder() .host("geode.example.com") .port(3141) .tls(tls_config) .build() .await?; </code></pre></div> <h3 id="certificate-pinning" class="position-relative d-flex align-items-center group"> Certificate Pinning <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="certificate-pinning" aria-haspopup="dialog" aria-label="Share link: Certificate Pinning"> Share link </button> </h3>Pin specific certificates for additional security: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml tls: pinning: enabled: true mode: "strict" # strict, report, or disabled # Pin by public key hash (SPKI) pins: - "sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=" - "sha256/CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC=" # Pin by certificate fingerprint fingerprints: - "sha256:AA:BB:CC:DD:..." </code></pre></div> <h3 id="ocsp-and-certificate-revocation" class="position-relative d-flex align-items-center group"> OCSP and Certificate Revocation <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="ocsp-and-certificate-revocation" aria-haspopup="dialog" aria-label="Share link: OCSP and Certificate Revocation"> Share link </button> </h3> <h4 id="ocsp-stapling" class="position-relative d-flex align-items-center group"> OCSP Stapling <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="ocsp-stapling" aria-haspopup="dialog" aria-label="Share link: OCSP Stapling"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml tls: ocsp: stapling: true responder_url: "http://ocsp.example.com" cache_duration: 3600 # seconds # Fail-open or fail-closed on OCSP failure strict: false </code></pre></div> <h4 id="crl-configuration" class="position-relative d-flex align-items-center group"> CRL Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="crl-configuration" aria-haspopup="dialog" aria-label="Share link: CRL Configuration"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml tls: crl: enabled: true urls: - "http://crl.example.com/ca.crl" refresh_interval: 3600 # seconds cache_path: "/var/cache/geode/crl" </code></pre></div> <h3 id="session-resumption" class="position-relative d-flex align-items-center group"> Session Resumption <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="session-resumption" aria-haspopup="dialog" aria-label="Share link: Session Resumption"> Share link </button> </h3>TLS 1.3 supports efficient session resumption: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># geode.yaml tls: session_resumption: enabled: true ticket_lifetime: 86400 # 24 hours max_early_data: 16384 # bytes # 0-RTT early data (use with caution) allow_0rtt: false # Vulnerable to replay attacks </code></pre></div> <h4 id="0-rtt-considerations" class="position-relative d-flex align-items-center group"> 0-RTT Considerations <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="0-rtt-considerations" aria-haspopup="dialog" aria-label="Share link: 0-RTT Considerations"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># Enable 0-RTT only for read-only operations tls: session_resumption: allow_0rtt: true 0rtt_allowed_operations: - "SELECT" - "MATCH" 0rtt_replay_protection: true </code></pre></div> <h3 id="tls-monitoring-and-debugging" class="position-relative d-flex align-items-center group"> TLS Monitoring and Debugging <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="tls-monitoring-and-debugging" aria-haspopup="dialog" aria-label="Share link: TLS Monitoring and Debugging"> Share link </button> </h3> <h4 id="connection-status" class="position-relative d-flex align-items-center group"> Connection Status <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="connection-status" aria-haspopup="dialog" aria-label="Share link: Connection Status"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Check TLS status geode tls-status # Output: # TLS Version: 1.3 # Cipher Suite: TLS_AES_256_GCM_SHA384 # Certificate Subject: CN=geode.example.com # Certificate Issuer: CN=Example CA # Certificate Valid: 2025-01-01 to 2026-01-01 # Client Auth: Required # OCSP Stapling: Enabled </code></pre></div> <h4 id="tls-metrics" class="position-relative d-flex align-items-center group"> TLS Metrics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="tls-metrics" aria-haspopup="dialog" aria-label="Share link: TLS Metrics"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># View TLS metrics geode metrics | grep tls # tls_handshakes_total{version="1.3",cipher="TLS_AES_256_GCM_SHA384"} 15234 # tls_handshake_errors_total{reason="expired_certificate"} 3 # tls_handshake_duration_seconds{quantile="0.99"} 0.045 # tls_client_auth_failures_total 12 </code></pre></div> <h4 id="debug-logging" class="position-relative d-flex align-items-center group"> Debug Logging <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="debug-logging" aria-haspopup="dialog" aria-label="Share link: Debug Logging"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Enable TLS debug logging geode serve --log-level=debug --log-components=tls # Log output includes: # [TLS] ClientHello received from 192.168.1.100 # [TLS] Selected cipher suite: TLS_AES_256_GCM_SHA384 # [TLS] Client certificate verified: CN=app-service # [TLS] Handshake completed in 23ms </code></pre></div> <h4 id="testing-tls-configuration" class="position-relative d-flex align-items-center group"> Testing TLS Configuration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="testing-tls-configuration" aria-haspopup="dialog" aria-label="Share link: Testing TLS Configuration"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Test with OpenSSL openssl s_client -connect geode.example.com:3141 \ -CAfile ca.crt \ -cert client.crt \ -key client.key # Test cipher suites nmap --script ssl-enum-ciphers -p 3141 geode.example.com # Test certificate chain openssl verify -CAfile ca.crt server.crt </code></pre></div> <h3 id="security-best-practices" class="position-relative d-flex align-items-center group"> Security Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="security-best-practices" aria-haspopup="dialog" aria-label="Share link: Security Best Practices"> Share link </button> </h3> <h4 id="1-use-strong-key-sizes" class="position-relative d-flex align-items-center group"> 1. Use Strong Key Sizes <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="1-use-strong-key-sizes" aria-haspopup="dialog" aria-label="Share link: 1. Use Strong Key Sizes"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># RSA: 4096 bits minimum for long-term keys openssl genrsa -out server.key 4096 # ECDSA: P-384 or P-521 curves openssl ecparam -genkey -name secp384r1 -out server.key # Ed25519: Modern, fast, secure openssl genpkey -algorithm ED25519 -out server.key </code></pre></div> <h4 id="2-protect-private-keys" class="position-relative d-flex align-items-center group"> 2. Protect Private Keys <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="2-protect-private-keys" aria-haspopup="dialog" aria-label="Share link: 2. Protect Private Keys"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Restrict file permissions chmod 400 /etc/geode/certs/server.key chown geode:geode /etc/geode/certs/server.key # Use encrypted key storage geode serve --tls-key-password-file=/etc/geode/secrets/key-password </code></pre></div> <h4 id="3-implement-certificate-monitoring" class="position-relative d-flex align-items-center group"> 3. Implement Certificate Monitoring <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="3-implement-certificate-monitoring" aria-haspopup="dialog" aria-label="Share link: 3. Implement Certificate Monitoring"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># Alert on certificate expiration monitoring: alerts: - name: cert_expiring_soon condition: tls_certificate_expiry_days < 30 action: notify_ops </code></pre></div> <h4 id="4-regular-security-audits" class="position-relative d-flex align-items-center group"> 4. Regular Security Audits <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="4-regular-security-audits" aria-haspopup="dialog" aria-label="Share link: 4. Regular Security Audits"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Check for weak configurations geode security-audit --component=tls # Output: # [PASS] TLS version 1.3 only # [PASS] Strong cipher suites # [PASS] Certificate valid for 180 days # [WARN] OCSP stapling not enabled # [PASS] Client authentication required </code></pre></div> <h4 id="5-defense-in-depth" class="position-relative d-flex align-items-center group"> 5. Defense in Depth <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="5-defense-in-depth" aria-haspopup="dialog" aria-label="Share link: 5. Defense in Depth"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># Combine TLS with network security security: tls: enabled: true require_client_certificates: true network: allowed_ips: - "10.0.0.0/8" - "192.168.1.0/24" rate_limiting: enabled: true max_connections_per_ip: 100 </code></pre></div> <h3 id="troubleshooting" class="position-relative d-flex align-items-center group"> Troubleshooting <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="troubleshooting" aria-haspopup="dialog" aria-label="Share link: Troubleshooting"> Share link </button> </h3> <h4 id="certificate-errors" class="position-relative d-flex align-items-center group"> Certificate Errors <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="certificate-errors" aria-haspopup="dialog" aria-label="Share link: Certificate Errors"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Verify certificate chain openssl verify -CAfile ca.crt -untrusted intermediate.crt server.crt # Check certificate details openssl x509 -in server.crt -noout -text # Check for SAN entries openssl x509 -in server.crt -noout -ext subjectAltName </code></pre></div> <h4 id="handshake-failures" class="position-relative d-flex align-items-center group"> Handshake Failures <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="handshake-failures" aria-haspopup="dialog" aria-label="Share link: Handshake Failures"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Debug handshake GEODE_TLS_DEBUG=1 geode shell --host=geode.example.com:3141 # Common issues: # - Certificate not trusted: Add CA to trust store # - Hostname mismatch: Check SAN entries # - Expired certificate: Renew certificate # - Cipher mismatch: Check supported ciphers </code></pre></div> <h4 id="performance-issues" class="position-relative d-flex align-items-center group"> Performance Issues <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="performance-issues" aria-haspopup="dialog" aria-label="Share link: Performance Issues"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Check handshake latency geode metrics | grep handshake_duration # Enable session resumption for repeat connections # Verify 0-RTT is working for allowed operations # Check for OCSP lookup delays </code></pre></div> <h3 id="related-topics" class="position-relative d-flex align-items-center group"> Related Topics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="related-topics" aria-haspopup="dialog" aria-label="Share link: Related Topics"> Share link </button> </h3><ul> <li><a href="/tags/encryption/" >Encryption</a> - Data encryption at rest</li> <li><a href="/tags/security/" >Security</a> - Security overview</li> <li><a href="/tags/authentication/" >Authentication</a> - Identity verification</li> <li><a href="/tags/compliance/" >Compliance</a> - Regulatory requirements</li> <li><a href="/tags/cryptography/" >Cryptography</a> - Cryptographic foundations</li> <li><a href="/tags/protocol/" >QUIC Protocol</a> - Transport protocol details</li> </ul> <h3 id="further-reading" class="position-relative d-flex align-items-center group"> Further Reading <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="further-reading" aria-haspopup="dialog" aria-label="Share link: Further Reading"> Share link </button> </h3><ul> <li><a href="/docs/architecture/security-architecture/" >Security Architecture</a> - Security design</li> <li><a href="/docs/ops/deployment/" >Deployment Guide</a> - Production deployment</li> <li><a href="/docs/configuration/" >Network Configuration</a> - Network settings</li> <li>TLS Best Practices Whitepaper - Enterprise TLS guidance</li> </ul>

Popular

Related Articles

Go Client

Python Client

Production Deployment Guide