[id='configuring-hotrod-encryption_{context}']
= Configuring Hot Rod client encryption
{brandname} Server can enforce SSL/TLS encryption and present Hot Rod clients with certificates to establish trust and negotiate secure connections.

To verify certificates issued to {brandname} Server, Hot Rod clients require either the full certificate chain or a partial chain that starts with the Root CA.
You provide server certificates to Hot Rod clients as trust stores.

By default, Hot Rod clients perform hostname validation by matching the `dNSName` or `iPAddress` values (or both) in the server certificate's `subjectAltName` extension with the expected hostname.

[TIP]
====
As an alternative to providing trust stores, you can use shared system certificates.
====

.Prerequisites

* Create a trust store that Hot Rod clients can use to verify {brandname} Server identities.
* If you configure {brandname} Server to validate or authenticate client certificates, create a keystore as appropriate.

.Procedure

. Add the trust store to the client configuration with the `trustStoreFileName()` and `trustStorePassword()` methods or corresponding properties.
. If you also configure client verification, do the following:
.. Add the keystore to the client configuration with the `keyStoreFileName()` and `keyStorePassword()` methods or corresponding properties.

.ConfigurationBuilder
[source,java,options="nowrap",subs=attributes+,role="primary"]
----
include::code_examples/HotRodClientTLS.java[]
----

.hotrod-client.properties
[source,options="nowrap",subs=attributes+,role="secondary"]
----
include::properties/hotrod-client-tls.properties[]
----

See xref:server-setup/java_client_server_setup.adoc#tls[Server Setup] to startup a server.

[role="_additional-resources"]
.Additional resources
* link:{server_docs}#endpoint-encryption[Encrypting {brandname} Server Connections]
* link:../../apidocs/org/infinispan/client/hotrod/configuration/SslConfigurationBuilder.html[SslConfigurationBuilder]
* link:../../apidocs/org/infinispan/client/hotrod/configuration/package-summary.html[Hot Rod client configuration properties]
* link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/securing_networks/using-shared-system-certificates_securing-networks[Using Shared System Certificates] (Red Hat Enterprise Linux 9 Securing Networks)
