TLS

Internal TLS

All internal communications are secured using TLS as part of the zero-trust approach. The minimum protocol version used is TLS 1.2.

Altair SLC Hub creates a root Certificate Authority (CA) at bootstrap. This is used to create certificate pairs for the Hub Server and Compute Nodes. To ensure the automatic transfer of these certificates is secure, a token with a 5 minute lifetime is created containing the Hash of the public CA and cryptographically random data. This token is returned from the hubctl worker add command-line. The token is then passed out-of-band to the hubctl worker register command on the compute node. The compute node can then get the public CA from the server over a TLS connection and manually confirm the certificate is correct, by checking the hash. Once the Compute node has the root CA it can download all the other required certificates for secure communication. This is shown in the diagram below: