The Orchestrator should use transport layer security (TLS) when serving traffic via its HTTP server. The Maverics console allows you to configure TLS for inbound connections from the Orchestrator Settings of a deployment. Optionally, multiple TLS configurations can be defined in order to support SNI-based TLS selection.
Orchestrator Restart Required
Changes to the TLS settings require a manual orchestrator restart to take effect.
Configuration Options
Default
When using SNI-based TLS selection, a key pair can be marked as the default. This key pair will be used when no other TLS configuration is matched to the request. When defining a global TLS configuration for the HTTP server, it will atomically be the default key pair.
Host
The server name value used for matching. The defined value will be matched with the server name indicator (SNI) value on the TLS handshake.
Key Pair Loading Method
Key pairs can be loaded either directly from the filesystem or the Windows Certificate Store. Please note that only one these loading methods can be used.
Certificate Path
The file path to your TLS certificate file. To specify the value as a secret, use <> brackets.
Key Path
The file path to your TLS key file. To specify the value as a secret, use <> brackets.
Subject
The subject of the certificate in the Windows Certificate Store.
Thumbprint
The thumbprint of the certificate in the Windows Certificate Store.
Minimum version
By default, the Orchestrator will allow TLS version 1.2 and higher. Optionally, admins can define the minimum TLS version to harden the security of their deployments. Please note that when using TLS 1.3, cipher suites are not configurable.
Cipher Selection
The Orchestrator uses a set of secure ciphers be default. Optionally, admins can override the behavior and select the ciphers that are suitable for their needs.
Enabled Secure Ciphers
Enabled secure ciphers defines the list of secure ciphers that will be used. By default, all the ciphers in the secure list are available for use by clients.
Enabled Insecure Ciphers
Enabled insecure ciphers defines the list of insecure ciphers that will be used. By default, none of the ciphers in the insecure list are available for use by clients.
Mutual TLS (mTLS)
The Orchestrator can optionally require clients to authenticate using mutual TLS.
Client Auth Type
Client auth type defines the behavior of how client certificates are verified:
NoClientCertindicates that no client certificate should be requested during the handshake, and if any certificates are sent they will not be verified.RequestClientCertindicates that a client certificate should be requested during the handshake, but does not require that the client send any certificates.RequireAnyClientCertindicates that a client certificate should be requested during the handshake, and that at least one certificate is required to be sent by the client, but that certificate is not required to be valid.VerifyClientCertIfGivenindicates that a client certificate should be requested during the handshake, but does not require that the client sends a certificate. If the client does send a certificate it is required to be valid.RequireAndVerifyClientCertindicates that a client certificate should be requested during the handshake, and that at least one valid certificate is required to be sent by the client.
Client CA Files
The client CA files define the set of root certificate authorities that the server uses to verify a client certificate.
Online Certificate Status Protocol (OCSP)
OCSP can be used to check the revocation status of client certificates.
When using OCSP, a custom cache timeout can be set. The default cache timeout for a given client certificate is 24 hours. Setting the cache timeout to a negative value (e.g., -1) instructs the Orchestrator to disable caching of OCSP responses. Disabling caching is highly discouraged, as it may result in significant performance degradation. This option is primarily intended for troubleshooting, allowing administrators to debug issues in the request flow.
Certificate Revocation List (CRL)
CRL can be used to check the revocation status of client certificates.
When using CRL, a custom cache timeout can be set. The default cache timeout for a given client certificate is 24 hours. Setting the cache timeout to a negative value (e.g., -1) instructs the Orchestrator to disable caching of CRLs. Disabling caching is highly discouraged, as it may result in significant performance degradation. This option is primarily intended for troubleshooting, allowing administrators to debug issues in the request flow.