Prepare the required certificates on the hosts before you link a dSource or provision a VDB with TLS enabled. YugabyteDB TLS certificates support node-to-node and client-to-node encryption.

TLS management modes

  • Disabled: No encryption.

  • YBA Self-Signed (Auto): Available for dSources only. Yugabyte Anywhere (YBA) generates and distributes certificates.

  • Customer Self-Signed: For dSources, provide the root CA certificate and key so YBA can sign node certificates. For VDBs, place the required certificate files on each node.

  • CA-Signed: Place the CA-signed certificates and keys on every node. Use the same file paths on each node.

Certificate files and permissions

For Customer Self-Signed or CA-Signed TLS, place the following PEM files on each YugabyteDB host:

  • ca.crt: Root CA certificate. Set permissions to 0644 and owner to yugabyte.

  • node.<bind-address>.crt: Host certificate. Set permissions to 0644 and owner to yugabyte.

  • node.<bind-address>.key: Host private key. Use an RSA key that is at least 2048 bits. Set permissions to 0600 and owner to yugabyte.

The bind address in each file name must match the IP address or hostname entered for that node. The host certificate Subject Alternative Name (SAN) must include both the DNS hostname and IPv4 address.

Do not place ca.key on a YugabyteDB host. For dSources using Customer Self-Signed mode, provide the root CA key on the staging node.

VDB certificate directories

For VDBs, set the Node Certificates Directory to the directory containing ca.crt, node.<bind-address>.crt, and node.<bind-address>.key for node-to-node encryption. Set the Client Certificates Directory to the directory containing the same files for client-to-node encryption. Both settings can use the same directory.

Verify a certificate

Use OpenSSL to verify a node certificate against its root CA certificate:

openssl verify -CAfile ca.crt node.<host>.crt

Last updated
Oct 19, 2026