[id='configuring-jgroups-sym-encrypt_{context}']
= Securing cluster transport with symmetric encryption
Configure {brandname} clusters to encrypt JGroups messages with secret keys from keystores that you provide.

.Procedure

. Create a keystore that contains a secret key.
. Place the keystore on the classpath for each node in the cluster.
+
For {brandname} Server, you put the keystore in the {server_home} directory.
+
. Add the `SYM_ENCRYPT` protocol to a JGroups stack in your {brandname} configuration.

[source,xml,options="nowrap",subs=attributes+]
----
include::xml/jgroups_sym_encrypt.xml[]
----

.Verification

When you start your {brandname} cluster, the following log message indicates that the cluster is using the secure JGroups stack:

[source,bash,options="nowrap"]
----
[org.infinispan.CLUSTER] ISPN000078: Starting JGroups channel cluster with stack <encrypted_stack_name>
----

{brandname} nodes can join the cluster only if they use `SYM_ENCRYPT` and can obtain the secret key from the shared keystore.
Otherwise the following message is written to {brandname} logs:

----
[org.jgroups.protocols.SYM_ENCRYPT] <hostname>: received message without encrypt header from <hostname>; dropping it
----

[role="_additional-resources"]
.Additional resources
* link:{jgroups_docs}[JGroups 4 Manual]
* link:{jgroups_schema}[JGroups 4.2 Schema]
