470/security/internal-communication.html

<!DOCTYPE html>

<html lang="en" data-content_root="../">
  <head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.18.1: http://docutils.sourceforge.net/" />

  <meta name="viewport" content="width=device-width,initial-scale=1">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  <meta name="lang:clipboard.copy" content="Copy to clipboard">
  <meta name="lang:clipboard.copied" content="Copied to clipboard">
  <meta name="lang:search.language" content="en">
  <meta name="lang:search.pipeline.stopwords" content="True">
  <meta name="lang:search.pipeline.trimmer" content="True">
  <meta name="lang:search.result.none" content="No matching documents">
  <meta name="lang:search.result.one" content="1 matching document">
  <meta name="lang:search.result.other" content="# matching documents">
  <meta name="lang:search.tokenizer" content="[\s\-]+">

  
    <link href="https://fonts.gstatic.com/" rel="preconnect" crossorigin>
    <link href="https://fonts.googleapis.com/css?family=Roboto+Mono:400,500,700|Roboto:300,400,400i,700&display=fallback" rel="stylesheet">

    <link href="https://fonts.googleapis.com/css2?family=Alata&family=Open+Sans:ital,wght%400,300;0,400;0,600;1,400&display=swap" rel="stylesheet">
    <style>
      body,
      input {
        font-family: "Roboto", "Helvetica Neue", Helvetica, Arial, sans-serif
      }

      code,
      kbd,
      pre {
        font-family: "Roboto Mono", "Courier New", Courier, monospace
      }
    </style>
  

  <link rel="stylesheet" href="../_static/stylesheets/application.css"/>
  <link rel="stylesheet" href="../_static/stylesheets/application-palette.css"/>
  <link rel="stylesheet" href="../_static/stylesheets/application-fixes.css"/>
  
  <link rel="stylesheet" href="../_static/fonts/material-icons.css"/>
  
  <meta name="theme-color" content="2196f3">
  <script src="../_static/javascripts/modernizr.js"></script>
  
  
    <title>Secure internal communication &#8212; Trino 470 Documentation</title>
    <link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=bbebba6e" />
    <link rel="stylesheet" type="text/css" href="../_static/material.css?v=79c92029" />
    <link rel="stylesheet" type="text/css" href="../_static/copybutton.css?v=76b2166b" />
    <link rel="stylesheet" type="text/css" href="../_static/trino.css?v=daa3c281" />
    <script src="../_static/jquery.js?v=5d32c60e"></script>
    <script src="../_static/_sphinx_javascript_frameworks_compat.js?v=2cd50e6c"></script>
    <script src="../_static/documentation_options.js?v=914e133e"></script>
    <script src="../_static/doctools.js?v=9a2dae69"></script>
    <script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
    <script src="../_static/clipboard.min.js?v=a7894cd8"></script>
    <script src="../_static/copybutton.js?v=f281be69"></script>
    <link rel="canonical" href="https://trino.io/docs/current/security/internal-communication.html" />
    <link rel="index" title="Index" href="../genindex.html" />
    <link rel="search" title="Search" href="../search.html" />
    <link rel="next" title="Secrets" href="secrets.html" />
    <link rel="prev" title="Ranger access control" href="ranger-access-control.html" />
  
   
    <script async src="https://www.googletagmanager.com/gtag/js?id=G-RJ94STKPJ5"></script>
    <script>
      window.dataLayer = window.dataLayer || [];
      function gtag(){dataLayer.push(arguments);}
      gtag('js', new Date());
      gtag('config', 'G-RJ94STKPJ5');
      gtag('config', 'UA-133457846-1');
      gtag('config', 'AW-1036784065');
      window._linkedin_data_partner_ids = ['2842796'];
    </script>
    <script async src="https://snap.licdn.com/li.lms-analytics/insight.min.js"></script>
  </head>
  <body dir=ltr
        data-md-color-primary= data-md-color-accent=>
  
  <svg class="md-svg">
    <defs data-children-count="0">
      
      <svg xmlns="http://www.w3.org/2000/svg" width="416" height="448" viewBox="0 0 416 448" id="__github"><path fill="currentColor" d="M160 304q0 10-3.125 20.5t-10.75 19T128 352t-18.125-8.5-10.75-19T96 304t3.125-20.5 10.75-19T128 256t18.125 8.5 10.75 19T160 304zm160 0q0 10-3.125 20.5t-10.75 19T288 352t-18.125-8.5-10.75-19T256 304t3.125-20.5 10.75-19T288 256t18.125 8.5 10.75 19T320 304zm40 0q0-30-17.25-51T296 232q-10.25 0-48.75 5.25Q229.5 240 208 240t-39.25-2.75Q130.75 232 120 232q-29.5 0-46.75 21T56 304q0 22 8 38.375t20.25 25.75 30.5 15 35 7.375 37.25 1.75h42q20.5 0 37.25-1.75t35-7.375 30.5-15 20.25-25.75T360 304zm56-44q0 51.75-15.25 82.75-9.5 19.25-26.375 33.25t-35.25 21.5-42.5 11.875-42.875 5.5T212 416q-19.5 0-35.5-.75t-36.875-3.125-38.125-7.5-34.25-12.875T37 371.5t-21.5-28.75Q0 312 0 260q0-59.25 34-99-6.75-20.5-6.75-42.5 0-29 12.75-54.5 27 0 47.5 9.875t47.25 30.875Q171.5 96 212 96q37 0 70 8 26.25-20.5 46.75-30.25T376 64q12.75 25.5 12.75 54.5 0 21.75-6.75 42 34 40 34 99.5z"/></svg>
      
    </defs>
  </svg>
  
  <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer">
  <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search">
  <label class="md-overlay" data-md-component="overlay" for="__drawer"></label>
  <a href="#security/internal-communication" tabindex="1" class="md-skip"> Skip to content </a>
  <header class="md-header" data-md-component="header">
    <nav class="md-header-nav md-grid">
        <div class="md-flex navheader">
            <div class="md-flex__cell md-flex__cell--shrink">
                <a href="/" title="Trino"
                   class="md-header-nav__button md-logo">
                    
                    <!-- https://github.com/bashtage/sphinx-material/issues/136 -->
                    <img src="../_static/trino.svg" height="26"
                         alt="Trino 470 Documentation logo">
                    
                </a>
            </div>
            <div class="md-flex__cell md-flex__cell--shrink">
                <label class="md-icon md-icon--menu md-header-nav__button" for="__drawer"></label>
            </div>
            <div class="md-flex__cell md-flex__cell--stretch">
                <div class="md-flex__ellipsis md-header-nav__title" data-md-component="title">
                    <span class="md-header-nav__topic">Trino 470 Documentation</span>
                    <span class="md-header-nav__topic"> Secure internal communication </span>
                </div>
            </div>
            <div class="md-flex__cell md-flex__cell--shrink">
                <label class="md-icon md-icon--search md-header-nav__button" for="__search"></label>
                
<div class="md-search" data-md-component="search" role="dialog">
  <label class="md-search__overlay" for="__search"></label>
  <div class="md-search__inner" role="search">
    <form class="md-search__form" action="../search.html" method="get" name="search">
      <input type="text" class="md-search__input" name="q" placeholder="Search"
             autocapitalize="off" autocomplete="off" spellcheck="false"
             data-md-component="query" data-md-state="active">
      <label class="md-icon md-search__icon" for="__search"></label>
      <button type="reset" class="md-icon md-search__icon" data-md-component="reset" tabindex="-1">
        &#xE5CD;
      </button>
    </form>
    <div class="md-search__output">
      <div class="md-search__scrollwrap" data-md-scrollfix>
        <div class="md-search-result" data-md-component="result">
          <div class="md-search-result__meta">
            Type to start searching
          </div>
          <ol class="md-search-result__list"></ol>
        </div>
      </div>
    </div>
  </div>
</div>

            </div>
            
            <div class="md-flex__cell md-flex__cell--shrink">
                <div class="md-header-nav__source">
                    <a href="https://github.com/trinodb/trino" title="Go to repository" class="md-source" data-md-source="github">

    <div class="md-source__icon">
      <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 24 24" width="28" height="28">
        <use xlink:href="#__github" width="24" height="24"></use>
      </svg>
    </div>
  
  <div class="md-source__repository">
    Trino
  </div>
</a>
                </div>
            </div>
            
            
  <script src="../_static/javascripts/version_dropdown.js"></script>
  <script>
    var json_loc = "../../versions.json",
        target_loc = "../../",
        text = "Versions";
    $( document ).ready( add_version_dropdown(json_loc, target_loc, text));
  </script>
  

        </div>
    </nav>
</header>

  
  <div class="md-container">
    
    
    <!-- empty -->
    <main class="md-main">
      <div class="md-main__inner md-grid" data-md-component="container">
        
          <div class="md-sidebar md-sidebar--primary" data-md-component="navigation">
            <div class="md-sidebar__scrollwrap">
              <div class="md-sidebar__inner">
                <nav class="md-nav md-nav--primary" data-md-level="0">
    <label class="md-nav__title md-nav__title--site" for="__drawer">
        <a href="/" title="Trino" class="md-nav__button md-logo">
            
            <img src="../_static/trino.svg" alt=" logo" width="48" height="48">
            
        </a>
        <a href="../index.html"
           title="Trino 470 Documentation">Trino 470 Documentation</a>
    </label>
    <div class="md-nav__source">
        <a href="https://github.com/trinodb/trino" title="Go to repository" class="md-source" data-md-source="github">

    <div class="md-source__icon">
      <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 24 24" width="28" height="28">
        <use xlink:href="#__github" width="24" height="24"></use>
      </svg>
    </div>
  
  <div class="md-source__repository">
    Trino
  </div>
</a>
    </div>
    
    
  <ul class="md-nav__list">
    <li class="md-nav__item">
    
    
      <a href="../overview.html" class="md-nav__link">Overview</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../installation.html" class="md-nav__link">Installation</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../client.html" class="md-nav__link">Clients</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../security.html" class="md-nav__link">Security</a>
      <ul class="md-nav__list"> 
    <li class="md-nav__item">
    
    
      <a href="overview.html" class="md-nav__link">Security overview</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="tls.html" class="md-nav__link">TLS and HTTPS</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="inspect-pem.html" class="md-nav__link">PEM files</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="inspect-jks.html" class="md-nav__link">JKS files</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="authentication-types.html" class="md-nav__link">Authentication types</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="password-file.html" class="md-nav__link">Password file authentication</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="ldap.html" class="md-nav__link">LDAP authentication</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="salesforce.html" class="md-nav__link">Salesforce authentication</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="oauth2.html" class="md-nav__link">OAuth 2.0 authentication</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="kerberos.html" class="md-nav__link">Kerberos authentication</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="certificate.html" class="md-nav__link">Certificate authentication</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="jwt.html" class="md-nav__link">JWT authentication</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="user-mapping.html" class="md-nav__link">User mapping</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="group-file.html" class="md-nav__link">File group provider</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="built-in-system-access-control.html" class="md-nav__link">System access control</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="file-system-access-control.html" class="md-nav__link">File-based access control</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="opa-access-control.html" class="md-nav__link">Open Policy Agent access control</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="ranger-access-control.html" class="md-nav__link">Ranger access control</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
    <input class="md-toggle md-nav__toggle" data-md-toggle="toc" type="checkbox" id="__toc">
    <label class="md-nav__link md-nav__link--active" for="__toc"> Secure internal communication </label>
    
      <a href="#" class="md-nav__link md-nav__link--active">Secure internal communication</a>
      
        
<nav class="md-nav md-nav--secondary">
    <label class="md-nav__title" for="__toc">Contents</label>
    <ul class="md-nav__list" data-md-scrollfix="">
        <li class="md-nav__item"><a href="#configure-shared-secret" class="md-nav__link">Configure shared secret</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#verify-configuration" class="md-nav__link">Verify configuration</a>
        </li></ul>
            </nav>
        </li>
        <li class="md-nav__item"><a href="#configure-internal-tls" class="md-nav__link">Configure internal TLS</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#performance-with-ssl-tls-enabled" class="md-nav__link">Performance with SSL/TLS enabled</a>
        </li>
        <li class="md-nav__item"><a href="#advanced-performance-tuning" class="md-nav__link">Advanced performance tuning</a>
        </li></ul>
            </nav>
        </li>
    </ul>
</nav>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="secrets.html" class="md-nav__link">Secrets</a>
      
    
    </li></ul>
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../admin.html" class="md-nav__link">Administration</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../optimizer.html" class="md-nav__link">Query optimizer</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../connector.html" class="md-nav__link">Connectors</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../object-storage.html" class="md-nav__link">Object storage</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../functions.html" class="md-nav__link">Functions and operators</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../udf.html" class="md-nav__link">User-defined functions</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../language.html" class="md-nav__link">SQL language</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../sql.html" class="md-nav__link">SQL statement syntax</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../develop.html" class="md-nav__link">Developer guide</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../glossary.html" class="md-nav__link">Glossary</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../appendix.html" class="md-nav__link">Appendix</a>
      
    
    </li>
    <li class="md-nav__item">
    
    
      <a href="../release.html" class="md-nav__link">Release notes</a>
      
    
    </li>
  </ul>
  

</nav>
              </div>
            </div>
          </div>
          <div class="md-sidebar md-sidebar--secondary" data-md-component="toc">
            <div class="md-sidebar__scrollwrap">
              <div class="md-sidebar__inner">
                
<nav class="md-nav md-nav--secondary">
    <label class="md-nav__title" for="__toc">Contents</label>
    <ul class="md-nav__list" data-md-scrollfix="">
        <li class="md-nav__item"><a href="#configure-shared-secret" class="md-nav__link">Configure shared secret</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#verify-configuration" class="md-nav__link">Verify configuration</a>
        </li></ul>
            </nav>
        </li>
        <li class="md-nav__item"><a href="#configure-internal-tls" class="md-nav__link">Configure internal TLS</a><nav class="md-nav">
                <ul class="md-nav__list">
        <li class="md-nav__item"><a href="#performance-with-ssl-tls-enabled" class="md-nav__link">Performance with SSL/TLS enabled</a>
        </li>
        <li class="md-nav__item"><a href="#advanced-performance-tuning" class="md-nav__link">Advanced performance tuning</a>
        </li></ul>
            </nav>
        </li>
    </ul>
</nav>
              </div>
            </div>
          </div>
        
        <div class="md-content">
          <article class="md-content__inner md-typeset" role="main">
            
  <section id="secure-internal-communication">
<h1 id="security-internal-communication--page-root">Secure internal communication<a class="headerlink" href="#security-internal-communication--page-root" title="Link to this heading">#</a></h1>
<p>The Trino cluster can be configured to use secured communication with internal
authentication of the nodes in the cluster, and to optionally use added security
with <a class="reference internal" href="../glossary.html#glosstls"><span class="std std-ref">TLS</span></a>.</p>
<section id="configure-shared-secret">
<span id="internal-secret"></span><h2 id="configure-shared-secret">Configure shared secret<a class="headerlink" href="#configure-shared-secret" title="Link to this heading">#</a></h2>
<p>You must configure a shared secret to authenticate all communication between
nodes of the cluster in the following scenarios:</p>
<ul class="simple">
<li><p>When using <a class="reference internal" href="authentication-types.html"><span class="doc std std-doc">any authentication</span></a> between clients and the
coordinator.</p></li>
<li><p>When using <a class="reference internal" href="#internal-tls"><span class="std std-ref">internal TLS encryption</span></a> between all nodes of the
cluster.</p></li>
</ul>
<p>Set the shared secret to the same value in <a class="reference internal" href="../installation/deployment.html#config-properties"><span class="std std-ref">config.properties</span></a> on all nodes of the cluster:</p>
<div class="highlight-text notranslate"><div class="highlight"><pre><span></span>internal-communication.shared-secret=&lt;secret&gt;
</pre></div>
</div>
<p>A large random key is recommended, and can be generated with the following Linux
command:</p>
<div class="highlight-text notranslate"><div class="highlight"><pre><span></span>openssl rand 512 | base64
</pre></div>
</div>
<section id="verify-configuration">
<span id="verify-secrets"></span><h3 id="verify-configuration">Verify configuration<a class="headerlink" href="#verify-configuration" title="Link to this heading">#</a></h3>
<p>To verify shared secret configuration:</p>
<ol class="arabic simple">
<li><p>Start your Trino cluster with two or more nodes configured with a shared
secret.</p></li>
<li><p>Connect to the <a class="reference internal" href="../admin/web-interface.html"><span class="doc">Web UI</span></a>.</p></li>
<li><p>Confirm the number of <code class="docutils literal notranslate"><span class="pre">ACTIVE</span> <span class="pre">WORKERS</span></code> equals the number of nodes
configured with your shared secret.</p></li>
<li><p>Change the value of the shared secret on one worker, and restart the worker.</p></li>
<li><p>Log in to the Web UI and confirm the number of <code class="docutils literal notranslate"><span class="pre">ACTIVE</span> <span class="pre">WORKERS</span></code> is one
less. The worker with the invalid secret is not authenticated, and therefore
not registered with the coordinator.</p></li>
<li><p>Stop your Trino cluster, revert the value change on the worker, and restart
your cluster.</p></li>
<li><p>Confirm the number of <code class="docutils literal notranslate"><span class="pre">ACTIVE</span> <span class="pre">WORKERS</span></code> equals the number of nodes
configured with your shared secret.</p></li>
</ol>
</section>
</section>
<section id="configure-internal-tls">
<span id="internal-tls"></span><h2 id="configure-internal-tls">Configure internal TLS<a class="headerlink" href="#configure-internal-tls" title="Link to this heading">#</a></h2>
<p>You can optionally add an extra layer of security by configuring the cluster to
encrypt communication between nodes with <a class="reference internal" href="../glossary.html#glosstls"><span class="std std-ref">TLS</span></a>.</p>
<p>You can configure the coordinator and all workers to encrypt all communication
with each other using TLS. Every node in the cluster must be configured. Nodes
that have not been configured, or are configured incorrectly, are not able to
communicate with other nodes in the cluster.</p>
<p>In typical deployments, you should enable <a class="reference internal" href="tls.html#https-secure-directly"><span class="std std-ref">TLS directly on the coordinator</span></a> for fully encrypted access to the cluster by client
tools.</p>
<p>Enable TLS for internal communication with the following
configuration identical on all cluster nodes.</p>
<ol class="arabic">
<li><p>Configure a shared secret for internal communication as described in
the preceding section.</p></li>
<li><p>Enable automatic certificate creation and trust setup in
<code class="docutils literal notranslate"><span class="pre">etc/config.properties</span></code>:</p>
<div class="highlight-properties notranslate"><div class="highlight"><pre><span></span><span class="na">internal-communication.https.required</span><span class="o">=</span><span class="s">true</span>
</pre></div>
</div>
</li>
<li><p>Change the URI for the discovery service to use HTTPS and point to the IP
address of the coordinator in <code class="docutils literal notranslate"><span class="pre">etc/config.properties</span></code>:</p>
<div class="highlight-properties notranslate"><div class="highlight"><pre><span></span><span class="na">discovery.uri</span><span class="o">=</span><span class="s">https://&lt;coordinator ip address&gt;:&lt;https port&gt;</span>
</pre></div>
</div>
<p>Note that using hostnames or fully qualified domain names for the URI is
not supported. The automatic certificate creation for internal TLS only
supports IP addresses.</p>
</li>
<li><p>Enable the HTTPS endpoint on all workers.</p>
<div class="highlight-properties notranslate"><div class="highlight"><pre><span></span><span class="na">http-server.https.enabled</span><span class="o">=</span><span class="s">true</span>
<span class="na">http-server.https.port</span><span class="o">=</span><span class="s">&lt;https port&gt;</span>
</pre></div>
</div>
</li>
<li><p>Restart all nodes.</p></li>
</ol>
<p>Certificates are automatically created and used to ensure all communication
inside the cluster is secured with TLS.</p>
<section id="performance-with-ssl-tls-enabled">
<h3 id="performance-with-ssl-tls-enabled">Performance with SSL/TLS enabled<a class="headerlink" href="#performance-with-ssl-tls-enabled" title="Link to this heading">#</a></h3>
<p>Enabling encryption impacts performance. The performance degradation can vary
based on the environment, queries, and concurrency.</p>
<p>For queries that do not require transferring too much data between the Trino
nodes e.g. <code class="docutils literal notranslate"><span class="pre">SELECT</span> <span class="pre">count(*)</span> <span class="pre">FROM</span> <span class="pre">table</span></code>, the performance impact is negligible.</p>
<p>However, for CPU intensive queries which require a considerable amount of data
to be transferred between the nodes (for example, distributed joins, aggregations and
window functions, which require repartitioning), the performance impact can be
considerable. The slowdown may vary from 10% to even 100%+, depending on the network
traffic and the CPU utilization.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>By default, internal communication with SSL/TLS enabled uses HTTP/2 for
increased scalability. You can turn off this feature with
<code class="docutils literal notranslate"><span class="pre">internal-communication.http2.enabled=false</span></code>.</p>
</div>
</section>
<section id="advanced-performance-tuning">
<span id="internal-performance"></span><h3 id="advanced-performance-tuning">Advanced performance tuning<a class="headerlink" href="#advanced-performance-tuning" title="Link to this heading">#</a></h3>
<p>In some cases, changing the source of random numbers improves performance
significantly.</p>
<p>By default, TLS encryption uses the <code class="docutils literal notranslate"><span class="pre">/dev/urandom</span></code> system device as a source of entropy.
This device has limited throughput, so on environments with high network bandwidth
(e.g. InfiniBand), it may become a bottleneck. In such situations, it is recommended to try
to switch the random number generator algorithm to <code class="docutils literal notranslate"><span class="pre">SHA1PRNG</span></code>, by setting it via
<code class="docutils literal notranslate"><span class="pre">http-server.https.secure-random-algorithm</span></code> property in <code class="docutils literal notranslate"><span class="pre">config.properties</span></code> on the coordinator
and all of the workers:</p>
<div class="highlight-text notranslate"><div class="highlight"><pre><span></span>http-server.https.secure-random-algorithm=SHA1PRNG
</pre></div>
</div>
<p>Be aware that this algorithm takes the initial seed from
the blocking <code class="docutils literal notranslate"><span class="pre">/dev/random</span></code> device. For environments that do not have enough entropy to seed
the <code class="docutils literal notranslate"><span class="pre">SHAPRNG</span></code> algorithm, the source can be changed to <code class="docutils literal notranslate"><span class="pre">/dev/urandom</span></code>
by adding the <code class="docutils literal notranslate"><span class="pre">java.security.egd</span></code> property to <code class="docutils literal notranslate"><span class="pre">jvm.config</span></code>:</p>
<div class="highlight-text notranslate"><div class="highlight"><pre><span></span>-Djava.security.egd=file:/dev/urandom
</pre></div>
</div>
</section>
</section>
</section>


          </article>
        </div>
      </div>
    </main>
  </div>
  <footer class="md-footer">
    <div class="md-footer-nav">
      <nav class="md-footer-nav__inner md-grid">
          
            <a href="ranger-access-control.html" title="Ranger access control"
               class="md-flex md-footer-nav__link md-footer-nav__link--prev"
               rel="prev">
              <div class="md-flex__cell md-flex__cell--shrink">
                <i class="md-icon md-icon--arrow-back md-footer-nav__button"></i>
              </div>
              <div class="md-flex__cell md-flex__cell--stretch md-footer-nav__title">
                <span class="md-flex__ellipsis">
                  <span
                      class="md-footer-nav__direction"> Previous </span> Ranger access control </span>
              </div>
            </a>
          
          
            <a href="secrets.html" title="Secrets"
               class="md-flex md-footer-nav__link md-footer-nav__link--next"
               rel="next">
            <div class="md-flex__cell md-flex__cell--stretch md-footer-nav__title"><span
                class="md-flex__ellipsis"> <span
                class="md-footer-nav__direction"> Next </span> Secrets </span>
            </div>
            <div class="md-flex__cell md-flex__cell--shrink"><i
                class="md-icon md-icon--arrow-forward md-footer-nav__button"></i>
            </div>
          
        </a>
        
      </nav>
    </div>
    <div class="md-footer-meta md-typeset">
      <div class="md-footer-meta__inner md-grid">
        <div class="md-footer-copyright">
        </div>
      </div>
    </div>
  </footer>
  <script src="../_static/javascripts/application.js"></script>
  <script>app.initialize({version: "1.0.4", url: {base: ".."}})</script>
  </body>
</html>