You can secure traffic between the driver and DSE with SSL. There are two aspects to that:

  • client-to-node encryption, where the traffic is encrypted, and the client verifies the identity of the DSE nodes it connects to;
  • optionally, client certificate authentication, where DSE nodes also verify the identity of the client.

This section describes the driver-side configuration; it assumes that you’ve already configured SSL in DSE:


Preparing the certificates

Client truststore

This is required for client-to-node encryption.



Then add all public certificates to the client truststore:




Client keystore


keytool -genkey -keyalg RSA -alias client -keystore client.keystore


keytool -export -alias client -file client.cer -keystore client.keystore


Driver configuration

The base class to configure SSL is RemoteEndpointAwareSSLOptions. It’s very generic, but you don’t necessarily need to deal with it directly: the default instance, or the provided subclasses, might be enough for your needs.

JSSE, Property-based

withSSL() gives you a basic JSSE configuration:

DseCluster cluster = DseCluster.builder()

# If you're using client authentication:

JSSE, programmatic

If you need more control than what system properties allow, you can configure SSL programmatically with RemoteEndpointAwareJdkSSLOptions:


RemoteEndpointAwareJdkSSLOptions sslOptions = RemoteEndpointAwareJdkSSLOptions.builder()

DseCluster cluster = DseCluster.builder()

Note that you can also extend the class and override newSSLEngine(SocketChannel,InetSocketAddress) if you need specific configuration on the SSLEngine (for example hostname verification).


RemoteEndpointAwareNettySSLOptions allows you to use Netty’s SslContext instead of the JDK directly. The advantage is that Netty can use OpenSSL directly, which provides better performance and generates less garbage. A disadvantage of using the OpenSSL provider is that it requires platform-specific dependencies, unlike the JDK provider.

Converting your client certificates for OpenSSL

OpenSSL doesn’t use keystores, so if you use client authentication and generated your certificates with keytool, you need to convert them.

  • use this command to extract the public certificate chain:

    keytool -export -keystore client.keystore -alias client -rfc -file client.crt
  • follow this tutorial to extract your client’s private key from client.keystore to a text file client.key in PEM format.

Updating your dependencies

Netty-tcnative provides the native integration with OpenSSL. Follow these instructions to add it to your dependencies.

There are known runtime incompatibilities between newer versions of netty-tcnative and the version of netty that the driver uses. For best results, use version 1.1.33.Fork26.

Using netty-tcnative requires JDK 1.7 or above and requires the presence of OpenSSL on the system. It will not fall back to the JDK implementation.

Configuring the context

Use the following Java code to configure OpenSSL with your certificates:

KeyStore ks = KeyStore.getInstance("JKS");
// make sure you close this stream properly (not shown here for brevity)
InputStream trustStore = new FileInputStream("client.truststore");
ks.load(trustStore, "password123".toCharArray());
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());

SslContextBuilder builder = SslContextBuilder
  // only if you use client authentication
  .keyManager(new File("client.crt"), new File("client.key"));

SSLOptions sslOptions = new RemoteEndpointAwareNettySSLOptions(;

DseCluster cluster = DseCluster.builder()