# (Solved) Correct setup of TLS for FoundationDB

**URL:** <https://forums.foundationdb.org/t/solved-correct-setup-of-tls-for-foundationdb/1037>\
**Category:** Using FoundationDB\
**Created:** [January 18, 2019, 1:14pm UTC](https://forums.foundationdb.org/t/solved-correct-setup-of-tls-for-foundationdb/1037 "2019-01-18T13:14:34Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![ajbeamon](https://sea1.discourse-cdn.com/foundationdb/user_avatar/forums.foundationdb.org/ajbeamon/32/13_2.png) [@ajbeamon](https://forums.foundationdb.org/u/ajbeamon)\
**Post date:** [January 18, 2019, 5:26pm UTC](https://forums.foundationdb.org/t/solved-correct-setup-of-tls-for-foundationdb/1037/4 "2019-01-18T17:26:09Z")

</div>

I’m not super familiar with our TLS configuration options, but I tried playing around with this myself to see what I could find. For my first attempt, I tried the following:

1. Update the cluster file to add the :tls suffix to each coordinator
2. Create a certificate and key file (I ran the commands listed in [this section](https://apple.github.io/foundationdb/tls.html#certificate-creation))
3. Add `tls_certificate_file`, `tls_key_file`, and `tls_verify_peers` to the `fdbserver` section of `foundationdb.conf`.

```auto
tls_certificate_file=/path/to/tls/fdb.pem
tls_key_file=/path/to/tls/private.key
tls_verify_peers=Check.Valid=0

```

1. I connected to the cluster using `fdbcli`, which required me to pass `--tls_certificate_file` and `--tls_key_file`. From a client, I think you would either use the corresponding client options or the environment variables.

Notice that I’m turning off peer verification, which allows me to get past the “VerifyError self signed certificate”.

Once I confirmed that worked, I tried turning back on peer verification by removing the `tls_verify_peers` parameter. I then got it to work by modifying `foundationdb.conf` to add `tls_ca_file=/path/to/tls/cert.crt`, which is one of the files generated in step #2 above.

One thing I noticed, though, is that it doesn’t appear that backup agents can accept these TLS parameters, so my backup agent is not able to connect. I suppose it could be made to work using the environment variables, but I’ll raise an issue to support the command line options as well.

---

_[View the full topic](https://forums.foundationdb.org/t/solved-correct-setup-of-tls-for-foundationdb/1037)._