TLS Certificate Placement
NCache uses TLS certificates to establish encrypted communication between clients, cache servers, and Bridge nodes. The certificates required on each machine depend on whether you configure regular TLS or mutual TLS and on the type of communication being protected.
Certificate placement follows two basic rules:
- An endpoint that presents its identity must have an identity certificate with its private key.
- An endpoint that validates another endpoint must trust the Certificate Authority (CA) that issued the presented certificate.
For example, when an NCache server presents a server certificate to a client, the server requires the certificate and its private key, while the client requires the certificate of the CA that issued the server certificate.
Important
Installing a certificate on a machine is not sufficient by itself. The NCache Service or client application must be able to access the certificate and, where applicable, its private key.
Regular TLS
Regular TLS, also referred to as one-way TLS, encrypts communication and authenticates the endpoint presenting the server certificate. The connecting endpoint validates the certificate but does not present its own identity certificate.
Therefore, regular TLS requires:
- A server identity certificate on the endpoint accepting the TLS connection.
- The issuing CA certificate on every endpoint that connects to and validates that server.
Client-Server Communication
For regular TLS between NCache clients and cache servers:
| Machine | Required Certificate | Certificate Store |
|---|---|---|
| Each NCache cache server | Server identity certificate with private key | Personal or My |
| Each client application machine | Root and intermediate CA certificates that issued the server certificate | Trusted Root or Root |
The NCache server presents its certificate during the TLS handshake. The client verifies that the certificate was issued by a trusted CA. A client identity certificate is not required for regular client-server TLS.
Server-Server Communication
Cache servers communicate with one another for clustering, replication, state transfer, and other distributed cache operations. Because any server can participate in these connections, install the server identity certificate on every cache server.
| Machine | Required Certificate | Certificate Store |
|---|---|---|
| Each cache server | Server identity certificate with private key | Personal or My |
| Each cache server | CA certificates that issued the certificates used by the other cache servers | Trusted Root or Root |
When the same CA issues all server certificates, installing that CA certificate on every server establishes trust across the cluster.
Bridge Communication
For TLS-protected Bridge communication, each NCache or Bridge endpoint that presents a certificate requires its identity certificate and private key. The communicating endpoint must trust the CA that issued that certificate.
| Machine | Required Certificate | Certificate Store |
|---|---|---|
| Bridge or cache endpoint presenting its identity | Server identity certificate with private key | Personal or My |
| Endpoint connecting to it | Root and intermediate CA certificates of the presenting endpoint | Trusted Root or Root |
When certificates from different CAs are used at different sites, install the appropriate CA certificates at each site so that both sides can validate the certificates they receive.
Mutual TLS
Mutual TLS, also referred to as two-way TLS, requires both communicating endpoints to authenticate themselves. During the TLS handshake:
- The server presents its server certificate to the connecting endpoint.
- The connecting endpoint presents its client or peer certificate to the server.
- Each endpoint validates the CA that issued the certificate presented by the other endpoint.
Mutual TLS therefore requires identity certificates and trust certificates on both sides of the connection.
Mutual Client-Server TLS
For mutual TLS between an NCache client and cache server, place the certificates as follows:
| Machine | Required Certificate | Certificate Store |
|---|---|---|
| NCache cache server | Server identity certificate with private key | Personal or My |
| NCache cache server | CA certificates that issued the client certificate | Trusted Root or Root |
| Client application machine | Client identity certificate with private key | Personal or My |
| Client application machine | CA certificates that issued the server certificate | Trusted Root or Root |
The client validates the server certificate, and the server validates the client certificate.
The server and client certificates can be issued by the same CA or by different CAs. When different CAs are used, each side must contain the CA certificate required to validate the certificate presented by the other side.
Note
A client certificate only needs to be installed on a cache server or Bridge node when a client application will also run from that machine.
Mutual Server-Server TLS
For mutual TLS between cache servers, each server acts as both a certificate presenter and certificate validator. Install the following on every cache server:
| Required Certificate | Certificate Store |
|---|---|
| Server identity certificate with private key | Personal or My |
| Root and intermediate CA certificates used to issue certificates to the other cache servers | Trusted Root or Root |
If all servers use certificates issued by one CA, each server only needs to trust that CA. If different servers use certificates from different CAs, every server must trust all relevant issuing CAs.
Mutual Bridge Communication
For mutual TLS across Bridge communication, each participating endpoint must present an identity certificate and validate the certificate presented by the remote endpoint.
| Machine | Required Certificate | Certificate Store |
|---|---|---|
| Each participating Bridge or cache endpoint | Identity certificate with private key | Personal or My |
| Each participating Bridge or cache endpoint | CA certificates that issued the remote endpoint's identity certificate | Trusted Root or Root |
This establishes encrypted and authenticated communication in both directions between the participating environments.
Certificate Placement on Windows
On Windows, certificates are available through the Local Machine and Current User certificate stores. The recommended placement is:
| Certificate | Recommended Windows Store |
|---|---|
| Server identity certificate with private key | Local Machine |
| Client identity certificate used by a Windows service | Local Machine |
| Client identity certificate used by a user application | Current User |
| Root CA certificate | Local Machine |
| Intermediate CA certificate | Local Machine |
Use the Local Machine store when NCache services or multiple application accounts require access to the certificate. A certificate placed in the Current User store is only available to processes running under that specific user account.
Important
The account running the NCache Service must have permission to read the private key of the server identity certificate. For mutual TLS, the account running the client application must also have access to the private key of the client identity certificate.
NCache can search for configured certificates in the following Windows store order:
- Local Machine: Trusted Root
- Local Machine: Personal
- Current User: Trusted Root
- Current User: Personal
Although NCache can locate certificates from these stores, identity certificates should normally be placed in the Personal store and CA certificates should be placed in the Trusted Root or appropriate intermediate CA store.
Certificate Placement on Linux
On Linux, install certificates in stores accessible to the account running the NCache Service or client application.
Use the following placement:
| Certificate | Linux Certificate Store |
|---|---|
| Server identity certificate with private key | My store |
| Client identity certificate with private key | My store |
| Root and intermediate CA certificates | Root or trusted certificate store |
The identity certificate must include an accessible private key. The root and intermediate CA certificates establish trust in certificates presented by remote clients, servers, or Bridge endpoints.
Important
Import the certificates for the account under which the NCache process runs. A certificate imported for another user may not be accessible to the NCache Service or client application.
When locating a configured identity certificate on Linux, NCache first searches the My store. If the configured certificate is not found in My, NCache also searches the Root store.
Note
The Install-PfxCertificate tool installs a certificate in the Root store by default. To install a server or client identity certificate in the My store, specify -StoreName My when running the tool.
Self-Signed Certificates
For a self-signed certificate, the certificate acts as its own issuing authority. Therefore, place the certificate with its private key on the endpoint that presents it and place a trusted copy of the certificate in the trust store of every endpoint that must validate it.
Warning
Self-signed certificates are generally suitable for development and testing. Use certificates issued by a trusted public or private CA for production deployments.
