When CSP PKI is deployed as a multi-node cluster, traffic exchanged between appliance nodes is cryptographically protected, except for monitoring traffic.
The appliance applies protection automatically; administrators need no configuration, certificate provisioning, or key management.
Internal services traffic
Traffic exchanged between the internal PKI services running on different nodes is transported inside an encrypted, mutually authenticated tunnel.
Property | Value |
|---|---|
Key agreement | Elliptic-curve Diffie-Hellman over Curve25519 (256-bit), with forward secrecy |
Peer authentication | Mutual, based on per-node public keys established at cluster formation |
Encryption | ChaCha20-Poly1305 (AEAD, 256-bit key) |
Integrity | Poly1305 authentication tag; replay protection with anti-replay window |
Hashing / key derivation | BLAKE2s |
Session keys | Ephemeral, re-negotiated periodically for the lifetime of the session |
Key storage | Node private keys are generated on the node and never transmitted |
This tunnel covers internal service traffic and replicated storage traffic between nodes.
Cluster management traffic
Cluster nodes continuously exchange and replicate the internal cluster state—the shared configuration that keeps all nodes consistent, the health and status information each node reports, and the distribution of workloads across nodes.
Property | Value |
|---|---|
Protocol negotiated | TLS 1.3 |
Cipher suite | AES-128-GCM-SHA256 |
Key agreement | ECDHE |
Authentication | Mutual TLS with certificates issued by an internal certification authority created during appliance installation |
Certificate keys | ECDSA on curve P-256 (256-bit) |
Certificate signature | ECDSA with SHA-256 |
Monitoring metrics traffic
A limited set of internal monitoring metrics is collected across nodes over unencrypted and unauthenticated HTTP. These metrics are neither encrypted nor carried inside the node-to-node tunnel.
Port | Content | Protection |
|---|---|---|
9100/tcp | Operating-system metrics of the node: CPU, memory, filesystem usage, network interfaces, and network connection counters | None — plain HTTP |
2381/tcp | Operational metrics of the cluster configuration datastore: database size, number of stored entries, and consensus timings | None — plain HTTP |
These endpoints:
- Expose operational data only. They carry no certificates, private keys, subject data, or end-user information.
- Are read-only. They accept no input and cannot modify the appliance.