Enable Network Encryption

MinIO AIStor implements Transport Layer Security (TLS) 1.2+ encryption with support for Server Name Indication (SNI) for selecting relevant TLS certificates in response to client requests.

You must set up TLS before you can enable data encryption, also called server-side encryption.

MinIO AIStor supports the following types of certificate signatures:

• self-signed

• internal or private certificate authorities (CAs)

• third-party CAs

Multiple certificates are implemented with SNI to determine which certificate to return to a client based on the hostname in the request.

This procedure uses the MinIO certgen tool to generate self-signed certificates for local testing and development purposes.

If the private.key mounted into the container is password protected, set the MINIO_CERT_PASSWD environment variable so AIStor can decrypt it at startup, and ensure the encrypted key uses the PKCS-1 format. See Encrypted private keys for the key conversion procedure.

Prerequisites

• The certgen tool for generating self-signed certificates.
• Alternatively, TLS certificates from your organization’s certificate authority.

Procedure

This procedure assumes you have

• previously completed the Install MinIO AIStor procedure.
• have the necessary directories with full write access.
• have a valid MinIO AIStor License, such as the MinIO AIStor Free license.

1. Generate TLS certificates

Use certgen to generate self-signed TLS certificates for testing and development. For production environments, use certificates issued by a trusted certificate authority.

Install certgen

Download the certgen binary for your platform from the releases page.

curl -L https://github.com/minio/certgen/releases/latest/download/certgen-linux-amd64 -o certgen
chmod +x certgen
sudo mv certgen /usr/local/bin/

curl -L https://github.com/minio/certgen/releases/latest/download/certgen-linux-arm64 -o certgen
chmod +x certgen
sudo mv certgen /usr/local/bin/

Generate certificates

Generate a certificate that includes the hostnames and IP addresses clients use to connect to MinIO AIStor.

mkdir -p $HOME/minio/certs
cd $HOME/minio/certs
certgen -host "127.0.0.1,localhost"

This creates public.crt and private.key files in the $HOME/minio/certs directory.

For additional hostnames or IP addresses, include them as a comma-separated list:

certgen -host "127.0.0.1,localhost,minio.example.com,192.168.1.100"

2. Run MinIO AIStor with TLS

Mount the certificate directory to the container to enable TLS. The following examples use the same directory structure as the installation procedure.

docker run -dt                                             \
  -p 9000:9000 -p 9001:9001                                \
  -v $HOME/minio/data:/mnt/data                            \
  -v $HOME/minio/certs:/etc/minio/certs                    \
  -v $HOME/minio/minio.license:/minio.license              \
  --name "aistor-server"                                   \
  quay.io/minio/aistor/minio:latest minio server /mnt/data \
  --license /minio.license                                 \
  --certs-dir /etc/minio/certs

docker logs aistor-server

podman run -dt                                             \
  -p 9000:9000 -p 9001:9001                                \
  -v $HOME/minio/data:/mnt/data                            \
  -v $HOME/minio/certs:/etc/minio/certs                    \
  -v $HOME/minio/minio.license:/minio.license              \
  --name "aistor-server"                                   \
  quay.io/minio/aistor/minio:latest minio server /mnt/data \
  --license /minio.license                                 \
  --certs-dir /etc/minio/certs

podman logs aistor-server

The --certs-dir flag tells MinIO AIStor where to find the TLS certificates. MinIO AIStor automatically enables TLS when it detects public.crt and private.key files in the specified directory.

3. Trust additional certificate authorities

If you need MinIO AIStor to trust certificates from additional certificate authorities, such as when connecting to MinIO KMS with self-signed certificates, place the CA certificates in the $HOME/minio/certs/CAs directory.

mkdir -p $HOME/minio/certs/CAs
cp /path/to/ca-certificate.crt $HOME/minio/certs/CAs/

When you start the container, the CA certificates are mounted to /etc/minio/certs/CAs and automatically trusted by MinIO AIStor.

4. Connect using HTTPS

When TLS is enabled, use https:// instead of http:// when connecting to MinIO AIStor.

Configure mc to trust the certificate

The mc client must trust the MinIO AIStor server’s certificate. The self-signed certificate generated by certgen acts as both the certificate and Certificate Authority (CA). Copy the certificate to the mc configuration directory:

mkdir -p ~/.mc/certs/CAs
cp $HOME/minio/certs/public.crt ~/.mc/certs/CAs/

Then create an alias using HTTPS:

mc alias set myaistor https://localhost:9000 minioadmin minioadmin

Alternatively, use the --insecure flag to skip certificate verification (not recommended for production):

mc alias set myaistor https://localhost:9000 minioadmin minioadmin --insecure

Access the Console

Open your browser to https://localhost:9001 to access the Console.

Recommendations for generating certificates

The following table provides MinIO's recommendations for TLS certificates for MinIO AIStor:

Supported TLS cipher suites

MinIO AIStor supports the following TLS 1.2 and 1.3 cipher suites. Recommended algorithms are marked with an asterisk (*):