# Temporal TLS Enabled

**URL:** <https://community.temporal.io/t/temporal-tls-enabled/5914>\
**Category:** Server Deployment\
**Tags:** java-sdk\
**Created:** [September 8, 2022, 9:31am UTC](https://community.temporal.io/t/temporal-tls-enabled/5914 "2022-09-08T09:31:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jaffarsadik](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/jaffarsadik/32/991_2.png) [@jaffarsadik](https://community.temporal.io/u/jaffarsadik)\
**Post date:** [September 8, 2022, 9:31am UTC](https://community.temporal.io/t/temporal-tls-enabled/5914/1 "2022-09-08T09:31:33Z")

</div>

@tihomir

Temporal-Server version: 1.16.2, ui-server: 2.2.0

I have deployed the Temporal in Kubernets by enabling the TLS with the below configuration. I can see the logs in temporal services and UI also able to communicate.

```auto
{"level":"debug","ts":"2022-09-05T11:23:19.402Z","msg":"attempted incoming TLS connection","address":"100.127.100.88:59556","server-name":"server-asyncworkflow-local-tls.jpmchase.net","logging-call-at":"localStoreTlsProvider.go:321"}
{"level":"debug","ts":"2022-09-05T11:23:19.402Z","msg":"returning TLS config for connection","address":"100.127.100.88:59556","server-name":"server-asyncworkflow-local-tls.jpmchase.net","logging-call-at":"localStoreTlsProvider.go:378"}

```

**Temporal-server** development.yaml

```auto
  tls:
    internode:
      server:
        certFile: /etc/temporal/certs/cluster.pem
        keyFile: /etc/temporal/certs/cluster.key
        requireClientAuth: false
        clientCaFiles:
          - /etc/temporal/certs/root_ca.pem
      client:
        serverName: server-asyncworkflow-local-tls.jpmchase.net
        rootCaFiles:
          - /etc/temporal/certs/root_ca.pem
    frontend:
      client:
        rootCaFiles:
          - /etc/temporal/certs/root_ca.pem
      server:
        requireClientAuth: false
        certFile: /etc/temporal/certs/cluster.pem
        keyFile: /etc/temporal/certs/cluster.key
        clientCaFiles:
          - /etc/temporal/certs/root_ca.pem
    systemWorker:
      certFile: /etc/temporal/certs/cluster.pem
      keyFile: /etc/temporal/certs/cluster.key
      client:
        forceTLS: true
        serverName: server-asyncworkflow-local-tls.jpmchase.net
        disableHostVerification: true
        rootCaFiles:
          - /etc/temporal/certs/root_ca.pem

```

**UI-Server** development.yaml (from UI i can able to see the workflows)

```auto
tls:
  caFile: /etc/temporal/certs/root_ca.pem
  certFile: /etc/temporal/certs/cluster.pem
  keyFile: /etc/temporal/certs/cluster.key
  enableHostVerification: false
  serverName: frontend:7233

```

I would like to connect from sdk-java client to temporal-server by passing the client key & certs.  
I have followed the instructions of [tls-simple](https://github.com/temporalio/samples-server/tree/main/tls/tls-simple) and the [code](https://github.com/temporalio/samples-java/blob/main/src/main/java/io/temporal/samples/ssl/SslEnabledWorker.java).

I am getting the below error, It looks to me Health check is failure.

> Exception in thread “main” io.grpc.StatusRuntimeException: UNAVAILABLE: upstream connect error or disconnect/reset before headers. reset reason: connection termination  
> at io.grpc.stub.ClientCalls.toStatusRuntimeException(ClientCalls.java:262)  
> at io.grpc.stub.ClientCalls.getUnchecked(ClientCalls.java:243)  
> at io.grpc.stub.ClientCalls.blockingUnaryCall(ClientCalls.java:156)  
> at io.grpc.health.v1.HealthGrpc$HealthBlockingStub.check(HealthGrpc.java:251)  
> at io.temporal.serviceclient.WorkflowServiceStubsImpl.lambda$checkHealth$2(WorkflowServiceStubsImpl.java:282)  
> at io.temporal.internal.retryer.GrpcSyncRetryer.retry(GrpcSyncRetryer.java:61)  
> at io.temporal.internal.retryer.GrpcRetryer.retryWithResult(GrpcRetryer.java:51)  
> at io.temporal.serviceclient.WorkflowServiceStubsImpl.checkHealth(WorkflowServiceStubsImpl.java:275)  
> at io.temporal.serviceclient.WorkflowServiceStubsImpl.(WorkflowServiceStubsImpl.java:182)  
> at io.temporal.serviceclient.WorkflowServiceStubs.newInstance(WorkflowServiceStubs.java:51)  
> at io.temporal.serviceclient.WorkflowServiceStubs.newInstance(WorkflowServiceStubs.java:41)  
> at com.jpmorgan.temporal.client.SslEnabledWorker.main(SslEnabledWorker.java:43)

I have tried same from **tctl cluster health** getting the below error.

> tctl --ad [server-asyncworkflow-local.apps.mt-d1.carl.gkp.jpmchase.net:443](http://server-asyncworkflow-local.apps.mt-d1.carl.gkp.jpmchase.net:443) --tls\_ca\_path certs/root\_ca.pem --tls\_disable\_host\_verification cluster health  
> Error: Unable to get “temporal.api.workflowservice.v1.WorkflowService” health check status.  
> Error Details: rpc error: code = Unavailable desc = upstream connect error or disconnect/reset before headers. reset reason: connection termination  
> Stack trace:  
> goroutine 1 [running]:  
> runtime/debug.Stack()  
> /usr/local/go/src/runtime/debug/stack.go:24 +0x65  
> runtime/debug.PrintStack()  
> /usr/local/go/src/runtime/debug/stack.go:16 +0x19  
> [github.com/temporalio/tctl/cli\_curr.printError](http://github.com/temporalio/tctl/cli_curr.printError)({0xc0005aa6c0, 0x54}, {0x2576ee0, 0xc0005bc018})  
> /home/tctl-builder/cli\_curr/util.go:392 +0x21e  
> [github.com/temporalio/tctl/cli\_curr.ErrorAndExit](http://github.com/temporalio/tctl/cli_curr.ErrorAndExit)({0xc0005aa6c0?, 0x25?}, {0x2576ee0?, 0xc0005bc018?})  
> /home/tctl-builder/cli\_curr/util.go:403 +0x28  
> [github.com/temporalio/tctl/cli\_curr.HealthCheck(0x356bb80?)](http://github.com/temporalio/tctl/cli_curr.HealthCheck(0x356bb80?))  
> /home/tctl-builder/cli\_curr/clusterCommands.go:50 +0x174  
> [github.com/temporalio/tctl/cli\_curr.newClusterCommands.func1(0xc00040ba20?)](http://github.com/temporalio/tctl/cli_curr.newClusterCommands.func1(0xc00040ba20?))  
> /home/tctl-builder/cli\_curr/cluster.go:36 +0x19  
> [github.com/urfave/cli.HandleAction](http://github.com/urfave/cli.HandleAction)({0x1ca14a0?, 0x21bfec0?}, 0x6?)  
> /root/go/pkg/mod/github.com/urfave/cli@v1.22.5/app.go:526 +0x50  
> [github.com/urfave/cli.Command.Run](http://github.com/urfave/cli.Command.Run)({{0x20dd46e, 0x6}, {0x0, 0x0}, {0xc000693850, 0x1, 0x1}, {0x211e9ca, 0x20}, {0x0, …}, …}, …)  
> /root/go/pkg/mod/github.com/urfave/cli@v1.22.5/command.go:173 +0x652  
> [github.com/urfave/cli.(\*App).RunAsSubcommand](http://github.com/urfave/cli.(*App).RunAsSubcommand)(0xc00078a000, 0xc00040b760)  
> /root/go/pkg/mod/github.com/urfave/cli@v1.22.5/app.go:405 +0x91b  
> [github.com/urfave/cli.Command.startApp](http://github.com/urfave/cli.Command.startApp)({{0x20dfac1, 0x7}, {0x0, 0x0}, {0xc000693930, 0x1, 0x1}, {0x2107e2b, 0x18}, {0x0, …}, …}, …)  
> /root/go/pkg/mod/github.com/urfave/cli@v1.22.5/command.go:372 +0x6e7  
> [github.com/urfave/cli.Command.Run](http://github.com/urfave/cli.Command.Run)({{0x20dfac1, 0x7}, {0x0, 0x0}, {0xc000693930, 0x1, 0x1}, {0x2107e2b, 0x18}, {0x0, …}, …}, …)  
> /root/go/pkg/mod/github.com/urfave/cli@v1.22.5/command.go:102 +0x808  
> [github.com/urfave/cli.(\*App).Run](http://github.com/urfave/cli.(*App).Run)(0xc000569c00, {0xc00012e000, 0x8, 0x8})  
> /root/go/pkg/mod/github.com/urfave/cli@v1.22.5/app.go:277 +0x8a7  
> main.main()  
> /home/tctl-builder/cmd/tctl/main.go:45 +0xa6

What is wrong with this?

---

<div class="post-metadata">

**Author:** ![tihomir](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/tihomir/32/6580_2.png) [@tihomir](https://community.temporal.io/u/tihomir)\
**Post date:** [September 8, 2022, 5:00pm UTC](https://community.temporal.io/t/temporal-tls-enabled/5914/2 "2022-09-08T17:00:19Z")

</div>

> tctl --ad [server-asyncworkflow-local.apps.mt-d1.carl.gkp.jpmchase.net:443](http://server-asyncworkflow-local.apps.mt-d1.carl.gkp.jpmchase.net:443/) --tls\_ca\_path certs/root\_ca.pem --tls\_disable\_host\_verification cluster health

Can you try specifying both client cert and key? for example:  
`-tls_cert_path <client.pem> --tls_key_path <client.key>`

---

<div class="post-metadata">

**Author:** ![jaffarsadik](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/jaffarsadik/32/991_2.png) [@jaffarsadik](https://community.temporal.io/u/jaffarsadik)\
**Post date:** [September 9, 2022, 2:06am UTC](https://community.temporal.io/t/temporal-tls-enabled/5914/3 "2022-09-09T02:06:53Z")

</div>

@tihomir

I have tried with client cert path & key, same error message.

![image](https://us1.discourse-cdn.com/flex016/uploads/temporal/original/2X/2/283246a5fa2258e4f5cd66d86f11238ac6eec244.png)

> $ tctl --ad [server-asyncworkflow-local.apps.mt-d1.carl.gkp.jpmchase.net:443](http://server-asyncworkflow-local.apps.mt-d1.carl.gkp.jpmchase.net:443) --tls\_ca\_path root\_ca.pem --tls\_cert\_path client/client.pem --tls\_key\_path client/client.key cluster health  
> Error: Unable to get “temporal.api.workflowservice.v1.WorkflowService” health check status.  
> Error Details: rpc error: code = Unavailable desc = upstream connect error or disconnect/reset before headers. reset reason: connection termination  
> Stack trace:  
> goroutine 1 [running]:  
> runtime/debug.Stack()  
> C:/JPMC/DEV/TMP/ds/tools/go1.18/latest/src/runtime/debug/stack.go:24 +0x65  
> runtime/debug.PrintStack()  
> C:/JPMC/DEV/TMP/ds/tools/go1.18/latest/src/runtime/debug/stack.go:16 +0x19  
> [github.com/temporalio/tctl/cli\_curr.printError](http://github.com/temporalio/tctl/cli_curr.printError)({0xc0005be180, 0x54}, {0x3190680, 0xc00013eb18})  
> I:/Code/asyncworkflow/tctl/async-workflow-temporal-tctl\_develop/cli\_curr/util.go:392 +0x21e  
> [github.com/temporalio/tctl/cli\_curr.ErrorAndExit](http://github.com/temporalio/tctl/cli_curr.ErrorAndExit)({0xc0005be180?, 0x25?}, {0x3190680?, 0xc00013eb18?})  
> **I:/Code/asyncworkflow/tctl/async-workflow-temporal-tctl\_develop/cli\_curr/util.go:403 +0x28**  
> **\> [github.com/temporalio/tctl/cli\_curr.HealthCheck(0x419b940?)](http://github.com/temporalio/tctl/cli_curr.HealthCheck(0x419b940?))**  
> I:/Code/asyncworkflow/tctl/async-workflow-temporal-tctl\_develop/cli\_curr/clusterCommands.go:50 +0x174  
> [github.com/temporalio/tctl/cli\_curr.newClusterCommands.func1(0xc00028b080?)](http://github.com/temporalio/tctl/cli_curr.newClusterCommands.func1(0xc00028b080?))  
> I:/Code/asyncworkflow/tctl/async-workflow-temporal-tctl\_develop/cli\_curr/cluster.go:36 +0x19  
> [github.com/urfave/cli.HandleAction](http://github.com/urfave/cli.HandleAction)({0x28ae9a0?, 0x2dcf6f8?}, 0x6?)  
> C:/JPMC/DEV/TMP/ds/data/go1.18/pkg/mod/github.com/urfave/cli@v1.22.5/app.go:526 +0x50  
> [github.com/urfave/cli.Command.Run](http://github.com/urfave/cli.Command.Run)({{0x2cea69b, 0x6}, {0x0, 0x0}, {0xc00058b7b0, 0x1, 0x1}, {0x2d2dbad, 0x20}, {0x0, …}, …}, …)  
> C:/JPMC/DEV/TMP/ds/data/go1.18/pkg/mod/github.com/urfave/cli@v1.22.5/command.go:173 +0x652  
> [github.com/urfave/cli.(\*App).RunAsSubcommand](http://github.com/urfave/cli.(*App).RunAsSubcommand)(0xc000779dc0, 0xc00028adc0)  
> C:/JPMC/DEV/TMP/ds/data/go1.18/pkg/mod/github.com/urfave/cli@v1.22.5/app.go:405 +0x91b  
> [github.com/urfave/cli.Command.startApp](http://github.com/urfave/cli.Command.startApp)({{0x2ceccca, 0x7}, {0x0, 0x0}, {0xc00058b890, 0x1, 0x1}, {0x2d164e1, 0x18}, {0x0, …}, …}, …)  
> C:/JPMC/DEV/TMP/ds/data/go1.18/pkg/mod/github.com/urfave/cli@v1.22.5/command.go:372 +0x6e7  
> [github.com/urfave/cli.Command.Run](http://github.com/urfave/cli.Command.Run)({{0x2ceccca, 0x7}, {0x0, 0x0}, {0xc00058b890, 0x1, 0x1}, {0x2d164e1, 0x18}, {0x0, …}, …}, …)  
> C:/JPMC/DEV/TMP/ds/data/go1.18/pkg/mod/github.com/urfave/cli@v1.22.5/command.go:102 +0x808  
> [github.com/urfave/cli.(\*App).Run](http://github.com/urfave/cli.(*App).Run)(0xc000779a40, {0xc00014c000, 0xb, 0x10})  
> C:/JPMC/DEV/TMP/ds/data/go1.18/pkg/mod/github.com/urfave/cli@v1.22.5/app.go:277 +0x8a7  
> main.main()  
> I:/Code/asyncworkflow/tctl/async-workflow-temporal-tctl\_develop/cmd/tctl/main.go:45 +0xa6

---

<div class="post-metadata">

**Author:** ![jaffarsadik](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/jaffarsadik/32/991_2.png) [@jaffarsadik](https://community.temporal.io/u/jaffarsadik)\
**Post date:** [September 13, 2022, 11:16am UTC](https://community.temporal.io/t/temporal-tls-enabled/5914/4 "2022-09-13T11:16:25Z")

</div>

@tihomir Did you get a change to look on this issue?

---

<div class="post-metadata">

**Author:** ![jaffarsadik](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/jaffarsadik/32/991_2.png) [@jaffarsadik](https://community.temporal.io/u/jaffarsadik)\
**Post date:** [September 26, 2022, 7:31am UTC](https://community.temporal.io/t/temporal-tls-enabled/5914/5 "2022-09-26T07:31:14Z")

</div>

@tihomir - any further update on this