Enable Network Encryption

AIStor implements Transport Layer Security (TLS) 1.2+ encryption with support for Server Name Indication (SNI) for selecting relevant TLS certificates in response to client requests.

You must set up TLS before you can enable data encryption, also called server-side encryption.

AIStor supports the following types of certificate signatures:

• self-signed

• internal or private certificate authorities (CAs)

• third-party CAs

Multiple certificates are implemented with SNI to determine which certificate to return to a client based on the hostname in the request.

This procedure uses the MinIO certgen tool to generate self-signed certificates for local testing and development purposes.

• The certgen tool for generating self-signed certificates.
• Alternatively, TLS certificates from your organization’s certificate authority.

This procedure assumes you have

• previously completed the Install AIStor procedure.
• have the necessary directories with full write access.
• have a valid AIStor License, such as the AIStor Free license.

Use certgen to generate self-signed TLS certificates for testing and development. For production environments, use certificates issued by a trusted certificate authority.

Download the certgen binary for your platform from the releases page.

curl -L https://github.com/minio/certgen/releases/latest/download/certgen-linux-amd64 -o certgen
chmod +x certgen
sudo mv certgen /usr/local/bin/

curl -L https://github.com/minio/certgen/releases/latest/download/certgen-linux-arm64 -o certgen
chmod +x certgen
sudo mv certgen /usr/local/bin/

Generate a certificate that includes the hostnames and IP addresses clients use to connect to AIStor.

mkdir -p $HOME/minio/certs
cd $HOME/minio/certs
certgen -host "127.0.0.1,localhost"

This creates public.crt and private.key files in the $HOME/minio/certs directory.

For additional hostnames or IP addresses, include them as a comma-separated list:

certgen -host "127.0.0.1,localhost,minio.example.com,192.168.1.100"

Mount the certificate directory to the container to enable TLS. The following examples use the same directory structure as the installation procedure.

docker run -dt                                             \
  -p 9000:9000 -p 9001:9001                                \
  -v $HOME/minio/data:/mnt/data                            \
  -v $HOME/minio/certs:/etc/minio/certs                    \
  -v $HOME/minio/minio.license:/minio.license              \
  --name "aistor-server"                                   \
  quay.io/minio/aistor/minio:latest minio server /mnt/data \
  --license /minio.license                                 \
  --certs-dir /etc/minio/certs

docker logs aistor-server

podman run -dt                                             \
  -p 9000:9000 -p 9001:9001                                \
  -v $HOME/minio/data:/mnt/data                            \
  -v $HOME/minio/certs:/etc/minio/certs                    \
  -v $HOME/minio/minio.license:/minio.license              \
  --name "aistor-server"                                   \
  quay.io/minio/aistor/minio:latest minio server /mnt/data \
  --license /minio.license                                 \
  --certs-dir /etc/minio/certs

podman logs aistor-server

The --certs-dir flag tells AIStor where to find the TLS certificates. AIStor automatically enables TLS when it detects public.crt and private.key files in the specified directory.

If you need AIStor to trust certificates from additional certificate authorities, such as when connecting to MinIO KMS with self-signed certificates, place the CA certificates in the $HOME/minio/certs/CAs directory.

mkdir -p $HOME/minio/certs/CAs
cp /path/to/ca-certificate.crt $HOME/minio/certs/CAs/

When you start the container, the CA certificates are mounted to /etc/minio/certs/CAs and automatically trusted by AIStor.

When TLS is enabled, use https:// instead of http:// when connecting to AIStor.

The mc client must trust the AIStor server’s certificate. The self-signed certificate generated by certgen acts as both the certificate and Certificate Authority (CA). Copy the certificate to the mc configuration directory:

mkdir -p ~/.mc/certs/CAs
cp $HOME/minio/certs/public.crt ~/.mc/certs/CAs/

Then create an alias using HTTPS:

mc alias set myaistor https://localhost:9000 minioadmin minioadmin

Alternatively, use the --insecure flag to skip certificate verification (not recommended for production):

mc alias set myaistor https://localhost:9000 minioadmin minioadmin --insecure

Open your browser to https://localhost:9001 to access the Console.