# Client-to-node Encryption

## Overview

Client-to-node encryption ensures the confidentiality and integrity of data
transmitted between client applications and ScyllaDB nodes. It mitigates
the risk of man-in-the-middle (MITM) attacks, packet sniffing, and credential
leakage as data moves across the network.

This kind of encryption handles **transport security only**. Authentication
remains a separate step, performed using standard credentials: username/password
with role-based access control (CQL) and access key/secret key (Alternator).

Client-to-node encryption in ScyllaDB Cloud utilizes the latest **Transport
Layer Security (TLS) version 1.3**.

### How It Works

1. The client connects to the cluster’s TLS endpoint.
2. The node presents its server certificate.
3. The client validates it using the ScyllaDB Cloud CA bundle.
4. An encrypted session is established.

## Default Behavior in ScyllaDB Cloud

Client-to-node encryption is fully managed by ScyllaDB Cloud.
It is enabled for all new clusters.

To ensure compatibility, ScyllaDB Cloud supports both encrypted and unencrypted
connections — the default port remains open for unencrypted traffic unless
encryption enforcement is enabled.

We recommend that you customize the configuration to
[enforce encrypted connections](#client-to-node-encryption-enforce).
As a result, the default port will be disabled, and the cluster nodes will
listen for [encrypted ports](#client-to-node-encryption-endpoints).

<a id="client-to-node-encryption-endpoints"></a>

## Supported Endpoints

| API                       |   Encrypted Port |
|---------------------------|------------------|
| CQL                       |             9142 |
| Alternator (DynamoDB API) |             8043 |

All client APIs are exposed through encrypted endpoints, ensuring:

* Data is protected in transit
* Server identity is verified
* Compliance with major security standards
* Safe connectivity over public or private networks

## Establishing Encrypted Connections

To establish an encrypted connection between clients and your cluster,
you need to:

1. [Obtain the CA public key](#client-to-node-encryption-obtain-key) for
   your cluster.
2. [Configure the client](#client-to-node-encryption-configure-client) to
   connect to your cluster using the key you downloaded.

<a id="client-to-node-encryption-obtain-key"></a>

### Obtain the Public Key

To obtain the public key for your cluster:

1. Log into the ScyllaDB Cloud.
2. Navigate to your cluster’s **Cluster Details page**.
3. Choose the option to **Download CA public key**.
   ![image](security/images/client-to-node-download-key.png)

   This will download the PEM format public key of your cluster, for example,
   `scylladb_cluster_ca.pem`.
4. Save the file locally.

<a id="client-to-node-encryption-configure-client"></a>

### Configure Your Client Driver

In your CQL or Alternator client application, configure the driver’s SSL/TLS
settings. Point the configuration to the
[location of the CA public key file you saved](#client-to-node-encryption-obtain-key).
This will allow your client to validate the server certificate presented by
the ScyllaDB node and establish an encrypted session.

For CQL clients, run the following CQL shell (cqlsh) command to connect to
your cluster:

```shell
SSL_CERTFILE=<location of your public key> cqlsh --ssl -u scylla -p <password> <node>
```

Example:

```shell
SSL_CERTFILE=~/scylladb_cluster_ca.pem cqlsh --ssl -u scylla -p aa1122cc3DD456 node-0.aws-us-east-1.593d90421f9dc28e6078.clusters.scylla.cloud
```

To obtain cluster-specific instructions, go to your cluster’s page in the ScyllaDB
Cloud application and see the **Connect** page.

<a id="client-to-node-encryption-enforce"></a>

## Enforcing Encrypted Connections

You can configure ScyllaDB to enforce encrypted connections, ensuring that
all traffic between clients and your cluster is encrypted.

1. Go to the **Security** section of your cluster page.
2. Click **Enable** next to **Ensure encrypted connections**.
   ![image](security/images/client-to-node-disabled.png)

This will terminate existing unencrypted connections and prevent any
unencrypted traffic between clients and ScyllaDB nodes.