These docs are for Cribl Edge 4.8 and are no longer actively maintained.

See the latest version (4.13).

TLS Defaults and System-wide Settings

Cribl Edge prioritizes secure communication by default. This ensures the integrity and confidentiality of data transmitted between your Cribl Edge instance and various Sources and Destinations.

TLS Version Support and Defaults

​

The minimum supported TLS version in Cribl Edge is TLS 1.2 by default. This default applies to all secure connections, including supported Sources and Destinations, Worker/Leader communications, and Cribl.Cloud.

Cribl.Cloud and on-prem deployments use the same TLS settings, with TLS 1.2 being the default minimum version.

You can check whether a Source or Destination supports TLS by reviewing the information box at the beginning of its corresponding documentation page.

TLS Settings and Traffic Types

​

This table shows TLS client/server pairs, and encryption defaults, per traffic type.

* Common name
† OpenID Connect

System-wide TLS Settings Including Ciphers

​

You can configure advanced, system-wide TLS settings – minimum and maximum TLS versions, default cipher lists, and ECDH curve names. Select Settings > Global Settings > System > General Settings > Default TLS Settings.

In the Default cipher list field, you can specify one or more ciphers from the following list:

• ECDHE-RSA-AES128-GCM-SHA256
• ECDHE-ECDSA-AES128-GCM-SHA256
• ECDHE-RSA-AES256-GCM-SHA384
• ECDHE-ECDSA-AES256-GCM-SHA384
• DHE-RSA-AES128-GCM-SHA256
• ECDHE-RSA-AES128-SHA256
• DHE-RSA-AES128-SHA256
• ECDHE-RSA-AES256-SHA384
• DHE-RSA-AES256-SHA384
• ECDHE-RSA-AES256-SHA256
• DHE-RSA-AES256-SHA256
• HIGH
• !aNULL
• !eNULL
• !EXPORT
• !DES
• !RC4
• !MD5
• !PSK
• !SRP
• !CAMELLIA

CA Certificates and Environment Variables

​

For any Cribl Edge Source or Destination that supports TLS, you can configure a CA Certificate Path field that points to a Certificate Authority (CA) .pem file(s). However, you can also use environment variables to manage CAs globally. Here are some common scenarios:

• Add a set of trusted root CAs to the list of trusted CAs that Cribl Edge trusts. Set the NODE_EXTRA_CA_CERTS environment variable for each Edge Node. For example, if you are using systemd, add the following line in each Edge Node’s systemd unit file (replace /<path>/<to>/<the>/<directory>/<containing>/<certs>/ca.pem with the path to your CA .pem file):

  ...
  [Service]
  Environment="NODE_EXTRA_CA_CERTS=/<path>/<to>/<the>/<directory>/<containing>/<certs>/ca.pem"
  ...

  Copy

  When configuring TLS authentication on Edge Nodes, make sure you place your certificates into a separate directory outside of $CRIBL_HOME. If you place the certificates inside $CRIBL_HOME, they’ll be removed when the next config bundle is deployed from the Leader.

  For details about NODE_EXTRA_CA_CERTS, see the node.js documentation.

• Configure Cribl Edge to accept all TLS certificates, regardless of their validity. Set the NODE_TLS_REJECT_UNAUTHORIZED environment variable for each Edge Node. For example, if you are using systemd, add the following line in each Edge Node’s systemd unit file:

  ...
  [Service]
  Environment="NODE_TLS_REJECT_UNAUTHORIZED=0"
  ...

  Copy

  NODE_TLS_REJECT_UNAUTHORIZED=0 disables TLS certificate validation, which can decrease the security posture of your Cribl installation. For this reason, we recommend avoiding NODE_TLS_REJECT_UNAUTHORIZED=0 in production environments. Instead, use the NODE_EXTRA_CA_CERTS environment variable to explicity trust the necessary certificates.

  For details about NODE_TLS_REJECT_UNAUTHORIZED, see the node.js documentation.