[id='configuring_jgroups_asym_encrypt-{context}']
= Configuring Cluster Transport with Asymmetric Encryption
Configure {brandname} clusters to generate and distribute secret keys that encrypt JGroups messages.

.Procedure

. Create a keystore with certificate chains that enables {brandname} to verify node identity.
. Place the keystore on the classpath for each node in the cluster.
+
For {brandname} Server, you put the keystore in the {server_home} directory.
+
. Add the `SSL_KEY_EXCHANGE` and `ASYM_ENCRYPT` protocols to a JGroups stack in your {brandname} configuration, as in the following example:
+
[source,xml,options="nowrap",subs=attributes+]
----
include::config_examples/jgroups_asym_encrypt.xml[]
----

.Verification

When you start your {brandname} cluster, the following log message indicates that the cluster is using the secure JGroups stack:

[source,bash,options="nowrap"]
----
[org.infinispan.CLUSTER] ISPN000078: Starting JGroups channel cluster with stack <encrypted_stack_name>
----

{brandname} nodes can join the cluster only if they use `ASYM_ENCRYPT` and can obtain the secret key from the coordinator node.
Otherwise the following message is written to {brandname} logs:

[source,bash,options="nowrap"]
----
[org.jgroups.protocols.ASYM_ENCRYPT] <hostname>: received message without encrypt header from <hostname>; dropping it
----

.Reference

The example `ASYM_ENCRYPT` configuration in this procedure shows commonly used parameters.
Refer to JGroups documentation for the full set of available parameters.

* link:{jgroups_docs}[JGroups 4 Manual]
* link:{jgroups_schema}[JGroups 4.2 Schema]
