SslConfig
SSL/TLS configuration for encrypted connections to ScyllaDB.
Enable with ssl { enabled = true; trustStorePath = "..." } for one-way TLS. Add keyStorePath for mutual TLS (client certificate authentication).
minimumTlsVersion, cipherSuites, and hostnameVerification are all applied through a custom SslEngineFactory (GH #78 / ISS-070) rather than CqlSession.builder().withSslContext(...) alone, which builds the driver's ProgrammaticSslEngineFactory with no cipher-suite restriction and no hostname validation regardless of driver config -- an SSLContext has no place to express a minimum protocol version or per-connection cipher restriction; that's an SSLEngine/ SSLParameters concern applied per connection.
Properties
Restricts the TLS cipher suites offered during the handshake to exactly this list, or null (default) to use the JVM/JSSE provider's own default enabled suites. An unsupported suite name throws IllegalArgumentException from the JSSE layer itself the first time the driver opens a connection -- Kandra does not pre-validate suite names against the JVM's supported list, since that list is provider- and JVM-version-dependent.
Enables hostname validation (HTTPS-style endpoint identification) against the server certificate. Applied directly on the javax.net.ssl.SSLEngine built for each connection (see class doc) -- only takes effect when enabled is also true.
Minimum TLS protocol version accepted during the handshake. Must be one of "TLSv1", "TLSv1.1", "TLSv1.2", or "TLSv1.3" -- any other value throws io.kandra.core.exception.KandraSchemaException at session-build time (only checked when enabled is true). All protocol versions at or above this one that the JVM's SSL provider actually supports are enabled; versions below it are disabled outright.
When true, refuses to build a com.datastax.oss.driver.api.core.CqlSession unless enabled is also true -- fails fast with io.kandra.core.exception.KandraSchemaException before any connection attempt. Defaults to false: SSL itself is opt-in (enabled defaults to false), so defaulting this to true would break every default KandraConfig that doesn't touch the ssl { } block at all. Turn this on explicitly in deployments where TLS must never accidentally be left off -- e.g. a staging/prod config bundle that sets ssl { enabled = true; requireEncryption = true; ... } as a guard against that enabled line being dropped later, or an environment-variable override silently disabling it. (GH #78 / ISS-070 -- this field used to be declared but never enforced at any default; enforcing it at its old default of true would have been a breaking change for every non-SSL deployment, which is why the default moved to false alongside adding real enforcement.)