Re: Optional TLS CQL Encryption

2016-04-20 Thread Jason Williams
Hi Sam, That's exactly what I was hoping for, but couldn't find in the docs. Thank you very much! -J Sent via iPhone > On Apr 20, 2016, at 02:05, Sam Tunnicliffe wrote: > > From 3.0, separate ports can be configured for encrypted & non-encrypted > connections. > See https://issues.apache.o

Re: Optional TLS CQL Encryption

2016-04-20 Thread Sam Tunnicliffe
>From 3.0, separate ports can be configured for encrypted & non-encrypted connections. See https://issues.apache.org/jira/browse/CASSANDRA-9590 On Wed, Apr 20, 2016 at 8:51 AM, Jason J. W. Williams < jasonjwwilli...@gmail.com> wrote: > Hi Ben, > > Thanks for confirming what I saw occur. The Datas

Re: Optional TLS CQL Encryption

2016-04-20 Thread Jason J. W. Williams
Hi Ben, Thanks for confirming what I saw occur. The Datastax drivers don't play very nicely with Twisted Python so connection pooling is inconsistent and makes always-on TLS a no-go performance-wise. The encryption overhead isn't the problem, it's the build-up of the TLS session for every connecti

Re: Optional TLS CQL Encryption

2016-04-19 Thread Ben Bromhead
Hi Jason If you enable encryption it will be always on. Optional encryption is generally a bad idea (tm). Also always creating a new session every query is also a bad idea (tm) even without the minimal overhead of encryption. If you are really hell bent on doing this you could have a node that is

Optional TLS CQL Encryption

2016-04-19 Thread Jason J. W. Williams
Hey Guys, Is there a way to make TLS encryption optional for the CQL listener? We'd like to be able to use for remote management connections but not for same datacenter usage (since the build/up tear down cost is too high for things that don't use pools). Right now it appears if we enable encryp