Document updated on Jun 13, 2021
Enabling TLS for HTTPS and HTTP/2
There are two different strategies when using TLS over KrakenD:
- Use TLS for HTTPS and HTTP/2 in KrakenD
- Use a balancer with TLS termination in front of KrakenD (e.g., ELB, HAproxy)
In case you want to enable TLS in KrakenD you need to add a tls
key at service level (configuration’s file root) with at least the public key and the private key. When you add TLS, KrakenD listens only using TLS, and no traffic to plain HTTP is accepted.
Simple configuration for TLS
To start KrakenD with TLS you need to generate the certificate and provide both the public and the private key:
{
"version": 2,
"tls": {
"public_key": "/path/to/cert.pem",
"private_key": "/path/to/key.pem"
}
}
Full configuration for TLS
All the accepted options of the TLS configuration are:
public_key
: Absolute path to the public key, or relative to the current working directory (CWD)private_key
: Absolute path to the private key, or relative to the current working directory (CWD)
Plus these optional:
disabled
(boolean): A temporary flag to disable TLS (e.g: while in development)min_version
(string): Minimum TLS version (one ofSSL3.0
,TLS10
,TLS11
,TLS12
orTLS13
)max_version
(string): Maximum TLS version (one ofSSL3.0
,TLS10
,TLS11
,TLS12
orTLS13
)enable_mtls
(boolean): Whether to enable or not Mutual Authentication. When mTLS is enabled, all KrakenD endpoints require clients to provide a known client-side X.509 authentication certificate. KrakenD relies on the system’s CA to validate certificates. See Mutual Authenticationcurve_preferences
(integer array): The list of all the identifiers for the curve preferences (use23
for CurveP256,24
for CurveP384 or25
for CurveP521)prefer_server_cipher_suites
(boolean): Enforces the use of one of the cipher suites offered by the server, instead of going with the suite proposed by the client.cipher_suites
(integer array): The list of cipher suites (see below). The list of cipher suites with its values is:5
: TLS_RSA_WITH_RC4_128_SHA10
: TLS_RSA_WITH_3DES_EDE_CBC_SHA47
: TLS_RSA_WITH_AES_128_CBC_SHA53
: TLS_RSA_WITH_AES_256_CBC_SHA60
: TLS_RSA_WITH_AES_128_CBC_SHA256156
: TLS_RSA_WITH_AES_128_GCM_SHA256157
: TLS_RSA_WITH_AES_256_GCM_SHA38449159
: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA49161
: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA49162
: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA49169
: TLS_ECDHE_RSA_WITH_RC4_128_SHA49170
: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA49171
: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA49172
: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA49187
: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA25649191
: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA25649199
: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA25649195
: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA25649200
: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA38449196
: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA38452392
: TLS_ECDHE_RSA_WITH_CHACHA20_POLY130552393
: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
TLS 1.3:
4865
: TLS_AES_128_GCM_SHA2564866
: TLS_AES_256_GCM_SHA3844867
: TLS_CHACHA20_POLY1305_SHA256
Default suites are:
49199
: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA25649195
: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA25649200
: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA38449196
: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA38452392
: TLS_ECDHE_RSA_WITH_CHACHA20_POLY130552393
: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305