4.6. TLS Erlang Distribution

4.6. TLS Erlang Distribution

The main purpose is specifically to allow using TLS for Erlang distribution between nodes, with the ability to connect to some nodes using TCP as well. TLS distribution will enhance data security during data migration between nodes.

This section describes how to enable TLS distribution for additional verification and security.

Reference: Using TLS for Erlang Distribution

4.6.1. Generate Certificate

For TLS to work properly, at least one public key and one certificate must be specified. In the following example (couch_ssl_dist.conf), the PEM file contains the certificate and its private key.

[{server,
  [{certfile, "</path/to/erlserver.pem>"},
   {secure_renegotiate, true}]},
 {client,
  [{secure_renegotiate, true}]}].

The following command is an example of generating a certificate (PEM) file.

$ openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout key.pem -out cert.pem
$ cat key.pem cert.pem > erlserver.pem && rm key.pem cert.pem

4.6.2. Config Settings

To enable TLS distribution, make sure to set custom parameters in vm.args.

# Don't forget to override the paths to point to your cert and conf file!
-proto_dist couch
-couch_dist no_tls \"clouseau@127.0.0.1\"
-ssl_dist_optfile <path/to/couch_ssl_dist.conf>

The no_tls flag can have these values:

Use TLS only, set to false (default value), such as:
```
-couch_dist no_tls false
```
Use TCP only, set to true, such as:
```
-couch_dist no_tls true
```

Specify some nodes to use TCP, others to use TLS, such as:

# Specify node1 and node2 to use TCP, others use TLS
-couch_dist no_tls \"node1@127.0.0.1\"
-couch_dist no_tls \"node2@127.0.0.1\"

# Any nodes end with "@127.0.0.1" will use TCP, others use TLS
-couch_dist no_tls \"*@127.0.0.1\"

4.6.3. Connect to Remsh

Start Erlang using a remote shell connected to Node.

If the node uses TCP:
```
$ ./remsh
```

If the node uses TLS:

$ ./remsh -t <path/to/couch_ssl_dist.conf>