From 349491937240b6320d789d64d49958fa97c4279e Mon Sep 17 00:00:00 2001 From: LandoVMW <45016198+LandoVMW@users.noreply.github.com> Date: Wed, 20 May 2020 12:48:31 -0700 Subject: [PATCH] Update configure-internal-tls.md Signed-off-by: LandoVMW --- docs/install-config/configure-internal-tls.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/install-config/configure-internal-tls.md b/docs/install-config/configure-internal-tls.md index 015320f0e..748090bab 100644 --- a/docs/install-config/configure-internal-tls.md +++ b/docs/install-config/configure-internal-tls.md @@ -3,20 +3,20 @@ title: Configure Internal TLS communication between Harbor Component weight: 30 --- - By default, The internal communication between Harbor's component (harbor-core,harbor-jobservice,proxy,harbor-portal,registry,registryctl,trivy_adapter,clair_adapter,chartmuseum) use HTTP protocol which might not be secure enough for some production environment. Since Harbor v2.0, TLS can be used for this internal network. In production environments, always use HTTPS is a recommended best practice. + By default, the internal communication between Harbor's components (harbor-core, harbor-jobservice, proxy,harbor-portal, registry, registryctl, trivy_adapter, clair_adapter, chartmuseum) use the HTTP protocol, which might not be secure enough for production environments. Since Harbor v2.0, TLS can be used for this internal network. In production environments, using HTTPS is a recommended best practice. -This functionality is introduced via the `internal_tls` in `harbor.yml` file. To enabled internal TLS, set `enabled` to `true` and set the `dir` value to the path of directory that contains the internal cert files. +This functionality is implemented using the `internal_tls` parameter in the `harbor.yml` file. To enable internal TLS, set `enabled` to `true` and set the `dir` value to the path of directory that contains the internal cert files. -All certs can be automatically generated by `prepare` tool. +You can generate certs using the `prepare` tool. ```bash docker run -v /:/hostfs goharbor/prepare:v2.0 gencert -p /path/to/internal/tls/cert ``` -User also can provide their own CA to generate the other certs. Just put certificate and key of the CA on internal tls cert directory and name them as `harbor_internal_ca.key` and `harbor_internal_ca.crt`. -Besides, a user can also provide the certs for all components. However, there are some constraints for the certs: +You can also provide your own CA to generate the other certs. To do this, put the certificate and key of the CA on internal tls cert directory, and name them `harbor_internal_ca.key` and `harbor_internal_ca.crt`. +You can also provide the certs for all components. However, there are some constraints for the certs: -* First, all certs must be signed by a single unique CA -* Second, the filename of the internal cert and `CN` field on cert file must follow the convention listed below' +* All certs must be signed by a single unique CA +* The filename of the internal cert and `CN` field on cert file must follow the conventions in the following table: |name|usage|CN| |---|---|---|