[id='configuring-hotrod-encryption_{context}']
= Configuring Hot Rod client encryption
{brandname} Server can enforce SSL/TLS encryption and present Hot Rod clients with certificates to establish trust and negotiate secure connections.

To verify certificates issued to {brandname} Server, Hot Rod clients require either the full certificate chain or a partial chain that starts with the Root CA.
You provide server certificates to Hot Rod clients as trust stores.

By default, Hot Rod clients will also perform hostname validation by matching the `dNSName` or `iPAddress` or both types contained by the server certificate's `subjectAltName` extension with the expected hostname.

[TIP]
====
Alternatively to providing trust stores you can use shared system certificates.
====

.Prerequisites

* Create a trust store that Hot Rod clients can use to verify {brandname} Server identities.
* If you configure {brandname} Server to validate or authenticate client certificates, create a keystore as appropriate.

.Procedure

. Add the trust store to the client configuration with the `trustStoreFileName()` and `trustStorePassword()` methods or corresponding properties.
. If you configure client certificate authentication, do the following:
.. Add the keystore to the client configuration with the `keyStoreFileName()` and `keyStorePassword()` methods or corresponding properties.
.. Configure clients to use the `EXTERNAL` authentication mechanism.

.ConfigurationBuilder
[source,java,options="nowrap",subs=attributes+,role="primary"]
----
include::code_examples/HotRodTLS.java[]
----

.hotrod-client.properties
[source,options="nowrap",subs=attributes+,role="secondary"]
----
include::properties/hotrod-client-tls.properties[]
----

.Next steps

Add a client trust store to the `{server_home}/server/conf` directory and configure {brandname} Server to use it, if necessary.

[role="_additional-resources"]
.Additional resources
* link:{server_docs}#endpoint-encryption[Encrypting {brandname} Server Connections]
* link:{javadocroot}/org/infinispan/client/hotrod/configuration/SslConfigurationBuilder.html[SslConfigurationBuilder]
* link:{javadocroot}/org/infinispan/client/hotrod/configuration/package-summary.html[Hot Rod client configuration properties]
* link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/securing_networks/using-shared-system-certificates_securing-networks[Using Shared System Certificates] (Red Hat Enterprise Linux 9 Securing Networks)
