How to Disable TLS on a TLS Enabled Consul Cluster

The information contained in this article has been verified as up-to-date on the date of the original publication of the article.  HashiCorp endeavors to keep this information up-to-date and correct, but it makes no representations or warranties of any kind, express or implied, about the ongoing completeness, accuracy, reliability, or suitability of the information provided.

All information contained in this article is for general information purposes only.  Any reliance you place on such information as it applies to your use of your HashiCorp product is therefore strictly at your own risk.

Purpose

This article talks about tips on disabling TLS in production scenarios with zero downtime. Consul uses TLS to verify the authenticity of servers and clients, disabling TLS should be a multi-staged approach.

Procedure

1. Locate your consul Server config file and Set verify_incoming to falseand Perform a rolling restart by restarting the follower and finally the leader. The leader should be restarted last, to avoid downtime.

2. Locate your consul Client config file and Set verify_incoming to falseand perform a rolling restart of the clients.

   • Check the server logs to see if the clients have joined successfully.

3. The next step is to Set verify_outgoing and verify_server_hostname to false on the consul Server config file and Perform a rolling restart by restarting the follower and finally the leader. The leader should be restarted last, to avoid downtime.

   • Note: On the client, you will see RPC related WARN, this should go away once you perform Step 4

4. Follow up on the Consul client config file by setting verify_outgoingand verify_server_hostnameto false and perform a rolling restart of the clients.

   • Check the server logs to see if the clients have joined successfully.

5. On the Server remove the verify_incoming, verify_outgoing, verify_server_hostname, and certificate-related configs and perform a rolling restart of the followers first and finally leader.

   • Note: On the client, you will see RPC related, this should go away once you perform Step 6.

6. Finally, from the Client remove the verify_incoming, verify_outgoing, verify_server_hostname, and certificate-related configs and perform a rolling restart of the clients.

   • Check the server logs to see if the clients have joined successfully.

Additional Information

The verify_incoming is for the servers to verify the authenticity of all incoming connections. All clients must have a valid key pair set using cert_file and key_file. Servers will also disallow any non-TLS connections.

The verify_outgoing is for the servers to verify the authenticity of the Consul for outgoing connections. Server nodes must present a certificate signed by a common certificate authority present on all agents, set via the agents ca_file and ca_path options. All server nodes must have an appropriate key pair set using cert_file and key_file.

The verify_server_hostname is for the servers to perform hostname verification. All servers must have a certificate valid  server.<datacenter>.<domain> or the client will reject the handshake. This is a new configuration as of 0.5.1, and it is used to prevent a compromised client from being able to restart in server mode and perform a MITM (Man-In-The-Middle) attack.