Enable Network Encryption

MinIO AIStor implements Transport Layer Security (TLS) 1.2+ encryption with support for Server Name Indication (SNI) for selecting relevant TLS certificates in response to client requests.

You must set up TLS before you can enable data encryption, also called server-side encryption.

MinIO AIStor supports the following types of certificate signatures:

• self-signed

• internal or private certificate authorities (CAs)

• third-party CAs

Multiple certificates are implemented with SNI to determine which certificate to return to a client based on the hostname in the request.

This procedure uses the MinIO certgen tool to generate self-signed certificates for local testing and development purposes.

Certificate path

MinIO AIStor on Windows uses a user-specified certificate directory. Use the --certs-dir flag to specify the path to your certificates:

minio.exe server --certs-dir C:\minio\certs C:\minio

When MinIO AIStor detects public.crt and private.key files in the specified directory, it automatically enables TLS.

If the private.key is password protected, set the MINIO_CERT_PASSWD environment variable so AIStor can decrypt it at startup, and ensure the encrypted key uses the PKCS-1 format. See Encrypted private keys for the key conversion procedure.

Prerequisites

• The certgen tool for generating self-signed certificates.
• Alternatively, TLS certificates from your organization’s certificate authority.

Procedure

This procedure assumes you have

• previously completed the Install MinIO AIStor procedure.
• have the necessary directories with full write access.
• have a valid MinIO AIStor License, such as the MinIO AIStor Free license.

1. Generate TLS certificates

Use certgen to generate self-signed TLS certificates for testing and development. For production environments, use certificates issued by a trusted certificate authority.

Install certgen

Download the certgen binary for Windows.

Invoke-WebRequest https://github.com/minio/certgen/releases/latest/download/certgen-windows-amd64.exe -OutFile C:\certgen.exe

Create the certificates directory

Create the directory where MinIO AIStor looks for TLS certificates.

md C:\minio\certs

Generate certificates

Generate a certificate that includes the hostnames and IP addresses clients use to connect to MinIO AIStor.

cd C:\minio\certs
C:\certgen.exe -host "127.0.0.1,localhost"

This creates public.crt and private.key files in the C:\minio\certs directory.

For additional hostnames or IP addresses, include them as a comma-separated list:

C:\certgen.exe -host "127.0.0.1,localhost,minio.example.com,192.168.1.100"

2. Run MinIO AIStor with TLS

MinIO AIStor automatically enables TLS when it detects public.crt and private.key files in the specified certificate directory. Use the --certs-dir flag to specify the certificate directory.

C:\minio.exe server C:\minio --license C:\minio\minio.license --certs-dir C:\minio\certs

The output indicates TLS is enabled when the URLs use https://:

MinIO Enterprise Object Store
API: https://192.168.86.35:9000  https://127.0.0.1:9000
   RootUser: minioadmin
   RootPass: minioadmin

WebUI: https://192.168.86.35:9001 https://127.0.0.1:9001
   RootUser: minioadmin
   RootPass: minioadmin

3. Trust additional certificate authorities

If you need MinIO AIStor to trust certificates from additional certificate authorities, such as when connecting to MinIO KMS with self-signed certificates, place the CA certificates in the C:\minio\certs\CAs directory.

md C:\minio\certs\CAs
copy C:\path\to\ca-certificate.crt C:\minio\certs\CAs\

4. Connect using HTTPS

When TLS is enabled, use https:// instead of http:// when connecting to MinIO AIStor.

Configure mc to trust the certificate

The mc client must trust the MinIO AIStor server’s certificate. The self-signed certificate generated by certgen acts as both the certificate and Certificate Authority (CA). Copy the certificate to the mc configuration directory:

md $env:USERPROFILE\.mc\certs\CAs
copy C:\minio\certs\public.crt $env:USERPROFILE\.mc\certs\CAs\

Then create an alias using HTTPS:

C:\mc.exe alias set myaistor https://localhost:9000 minioadmin minioadmin

Alternatively, use the --insecure flag to skip certificate verification (not recommended for production):

C:\mc.exe alias set myaistor https://localhost:9000 minioadmin minioadmin --insecure

Access the Console

Open your browser to https://localhost:9001 to access the Console.

Recommendations for generating certificates

The following table provides MinIO's recommendations for TLS certificates for MinIO AIStor:

Supported TLS cipher suites

MinIO AIStor supports the following TLS 1.2 and 1.3 cipher suites. Recommended algorithms are marked with an asterisk (*):