Node TLS

When Node DNS is configured, the Atlas Experience Manager can automatically order and issue TLS (formerly SSL) certificates for use by Nodes.

This enables HTTPS connections within the Atlas Experience Fabric, a private overlay network for always-on connectivity and distributed computing.

This guide walks through the necessary configuration for Node TLS.

Table of Contents

• Table of Contents
• Prerequisites
• Related Features
• Configuration
• Available TLS Backends
  • DNSimple (Let’s Encrypt)

Prerequisites

To Use Node TLS, the follow prerequisites are required:

1. Node DNS configured
2. Supported TLS certificate provider (currently Let’s Encrypt via DNSimple)
3. REST API Credentials for TLS Provider (see details under backends below)

Related Features

The following features are related to Node DNS:

• Experience Fabric - Node DNS support the Atlas Experience Fabric, a private overlay network for always-on connectivity and distributed computing.
• Node DNS - To use Node TLS, nodes must have a Fully Qualified Domain Name (FQDN) assigned to them via Node DNS.

Configuration

INFO

Additional Environment Variables will be required depending on the selected TLS backend.

Environment Variable	Description	Default
USE_NODE_TLS	Enable automatic Node TLS provisioning (True or False)	False
NODE_TLS_BACKEND	The TLS provider backend to use (see below)	None

TIP

Note that the NODE_DNS_DOMAIN configured with Node DNS is used when issuing TLS certificates. Only one domain may be used for Node DNS/TLS per Experience Manager installation.

Available TLS Backends

The follow TLS providers are available for automatic Node TLS provisioning:

Provider	Value
DNSimple (Let's Encrypt)	xot.common.dns.dnsimple.DnsimpleLetsEncryptTLSBackend

DNSimple (Let’s Encrypt)

WARNING

When using the DNSimple DnsimpleLetsEncryptTLSBackend, the NODE_DNS_BACKEND MUST use the DNSimpleDnsBackend. Certificates CANNOT be issued with this method if DNS is not provided by DNSimple.

Environment Variable	Description	Default
DNSIMPLE_ACCOUNT_ID	From your account page, select Account Settings / Access Tokens, your account ID will be displayed on this page.	False
DNSIMPLE_ACCESS_TOKEN	From your account page, select Account Settings / Access Tokens	None