Unable to Enable HTTPS When Deploying TiKV and PD Using YAML Configuration File with TiUP

Note:
This topic has been translated from a Chinese forum by GPT and might contain errors.

Original topic: tiup使用yaml配置文件部署tikv和pd无法启用https

| username: 月明星稀

[TiDB Usage Environment] Test
[TiDB Version] 6.5.0
[Reproduction Path]
[Encountered Problem: Problem Phenomenon and Impact]
Part of the yaml configuration file:
pd_servers:

  • host: 2.2.2.2
    data_dir: “/cache/pd-data”
    config:
    schedule.max-merge-region-size: 20
    schedule.max-merge-region-keys: 200000
    client-urls: “https://2.2.2.2:2379
    advertise-client-urls: “https://2.2.2.2:2379
    peer-urls: “https://2.2.2.2:2380
    advertise-peer-urls: “https://2.2.2.2:2380
    log.level: “debug”
    security:
    cert-allowed-cn: [“tikv.cn”]
    cacert-path: “/usr/local/tikv/etc/root.crt”
    cert-path: “/usr/local/tikv/etc/tikv.crt”
    key-path: “/usr/local/tikv/etc/tikv.key”

tikv_servers:

  • host: 1.1.1.1
    port: 20160
    status_port: 20180
    deploy_dir: “/usr/local/tikv/tikv-20160”
    log_dir: “/usr/local/tikv/tikv-20160/log”
    data_dir: “/cache/tikv-data/tikv-20160”
    config:
    security:
    cert-allowed-cn: [“tikv.cn”]
    ca-path: “/usr/local/tikv/etc/root.crt”
    cert-path: “/usr/local/tikv/etc/tikv.crt”
    key-path: “/usr/local/tikv/etc/tikv.key”
    Deployment command using tiup: echo Yes|tiup cluster deploy test_cluster v6.5.0 /etc/test.yaml --user tikv -i /tmp/key
    PD cannot use https when starting as shown in the picture: still http

    PD error log screenshot:

Experts, please help check if there is any problem with the configuration and why https cannot be enabled.

| username: 我是咖啡哥 | Original post link

I searched for a long time and couldn’t find the HTTPS configuration instructions. Which document did you refer to for the operation?

| username: 月明星稀 | Original post link

I would like to ask how you configure HTTPS mutual authentication. Thank you.

| username: zhanggame1 | Original post link

I’m quite curious, can one certificate be used in so many places?

| username: 我是咖啡哥 | Original post link

I haven’t configured it on my side.

| username: tidb菜鸟一只 | Original post link

These links are for internal access, so there’s no need to use HTTPS, right?

| username: 月明星稀 | Original post link

If it is listening on a public IP, the server needs to authenticate the client, otherwise any public user can operate on the data, which is risky. How do you ensure security?

| username: 像风一样的男子 | Original post link

Databases should not be exposed to the public network; it’s not safe.

| username: zhanggame1 | Original post link

I suggest implementing it through front-end network access devices and security protection devices, including data encryption, rather than relying on HTTPS for the data itself.

| username: 有猫万事足 | Original post link

This seems to be TLS, not HTTPS.
You should check the TLS section in the documentation to see if it is what you need.

HTTPS should be HTTP + TLS.

| username: zhanggame1 | Original post link

After version 3, HTTPS was renamed to TLS, but it’s still the same thing.