Skip to main content

Enable-ZrStoreTls

Provisions the cluster CA, then writes the TLS policy and trust anchor into every connected manager's instances of a store, optionally rolling-restarting its nodes so enforcement takes effect.

Syntax​

Enable-ZrStoreTls
    -Store <string>
    [-Mode <string>]
    [-IssuerNodeId <string>]
    [-Restart]
    [-CaFile <string>] [-CaPassword <SecureString>]
    [-Managers <string[]>] [-Port <int>] [-Token <string>] [-TimeoutSec <int>]
    [-WhatIf] [-Confirm]

Description​

Enable-ZrStoreTls provisions the cluster CA (sharing one CA across all managers so every node leaf is signed by the same authority), then writes the transport-TLS policy and trust anchor into the named store on every connected manager. Nodes enforce TLS only once restarted: pass -Restart to roll the store's nodes immediately, or apply the change and restart later.

-Mode selects the enforcement mode (for example server-only TLS or MutualTls); when omitted the server policy default is used. MutualTls is enforced node-to-node — external app clients still connect with the CA plus a token and need no client certificate.

-CaFile is a one-shot bring-your-own-CA: it adopts the supplied CA PKCS#12 (cert + key) before enabling, equivalent to running Import-ZrClusterCa first. After enabling, export the client trust file with Get-ZrClusterCaCert. Requires an active workspace or an explicit -Managers list.

See TLS encryption and CA trust modes for the concepts. The web console does the same thing under Security & TLS → Encryption, where an enabled store shows a 🔒 TLS active badge.

Encryption is not authentication

TLS encrypts the wire and authenticates the nodes — it does not require a token from callers. A TLS-only store is encrypted but still open to any client. Pair this with Enable-ZrStoreSecurity to require a token too.

Attach mode

When an orchestrator owns the nodes (attach mode), the manager cannot reconfigure them — this cmdlet reports "0 nodes updated." Declare security.tls in each node's configuration and restart; the store registration then records the TLS policy and the console/clients pick it up.

Parameters​

ParameterTypeRequiredDescription
-StorestringYesName of the store to enable transport TLS on. Position 0.
-ModestringNoTLS enforcement mode, for example server-only TLS or MutualTls; defaults to the server policy when omitted.
-IssuerNodeIdstringNoNode id of the CA issuer to use when signing the leaf certificates for the store's nodes.
-RestartswitchNoRolling-restarts the store's nodes so TLS enforcement activates immediately instead of on the next restart.
-CaFilestringNoA CA PKCS#12 (cert + key) to adopt as the cluster CA before enabling — node leaves are then signed by your CA (one-shot bring-your-own-CA).
-CaPasswordSecureStringNoPassword protecting -CaFile, if any.
-Managersstring[]NoManagement Service endpoints to target; when omitted the active workspace's managers are used.
-PortintNoManagement Service port for bare-host managers. Default 7801.
-TokenstringNoAdmin bearer token for authenticated control-plane calls.
-TimeoutSecintNoPer-request timeout in seconds. Default 30.

Supports -WhatIf and -Confirm.

Examples​

Provision the CA and enable mutual TLS on the orders store, restarting its nodes to activate enforcement.

Enable-ZrStoreTls -Store orders -Mode MutualTls -Restart

Enable TLS while adopting your own CA in one step, then export the client trust file.

Enable-ZrStoreTls -Store orders -CaFile enterprise-ca.pfx -CaPassword (Read-Host -AsSecureString) -Restart
Get-ZrClusterCaCert -OutFile cluster-ca.crt