yugabytedb

How to generate certs when creating a xCluster deployment in YugabyteDB

In an attempt to set up a transactional xCluster I'm faced with a critical issue.

The prerequisities page (https://docs.yugabyte.com/preview/deploy/multi-dc/async-replication/#prerequisites) talks about the certificates. The reference <base-dir> is ambiguous. Regardless if it's the data-dir or binaries directory I don't have a folder named certs anywhere. Docs don't cover anything about where these certs are coming from or what to do when the folder is missing.

Solution

  • The reference is ambiguous.

    Every command of yugabyted cli takes --base_dir as an argument, it just has a default value. It's the directory where yugabyted stores data, configurations, and logs. Must be an absolute path. By default base directory is $HOME/var. See flags for start command.

    Docs don't cover anything about where these certs are coming from or what to do when the folder is missing

    From: https://docs.yugabyte.com/preview/reference/configuration/yugabyted/#create-certificates-for-a-secure-local-multi-node-universe

    Generate the certificates using the --cert generate_server_certs command and then copy them to the respective node base directories before you create a secure local multi-node universe.

    Create the certificates for SSL and TLS connection:

    ./bin/yugabyted cert generate_server_certs --hostnames=127.0.0.1,127.0.0.2,127.0.0.3

    Certificates are generated in the <HOME>/var/generated_certs/<hostname> directory.

    Copy the certificates to the respective node's <base_dir>/certs directory:

    cp $HOME/var/generated_certs/127.0.0.1/* $HOME/yugabyte-2.25.2.0/node1/certs
cp $HOME/var/generated_certs/127.0.0.2/* $HOME/yugabyte-2.25.2.0/node2/certs
cp $HOME/var/generated_certs/127.0.0.3/* $HOME/yugabyte-2.25.2.0/node3/certs