NFS RPC over TLS Setup and Verification Guide

1. Prerequisites

Supported Client OS:

• RHEL / Rocky / AlmaLinux ≥ 9.5 (Native NFS Client)

• SLES > 15 SP5

• When using VastNFS: vastnfs ≥ 4.5.x

git clone git@git.vastdata.com:kernel/mlnx-nfsrdma.git
cd mlnx-nfsrdma
git checkout origin/next/4.5.x

Cluster Setting:

vtool vsettings set NFS_ALLOW_TLS_1_3=true

Vast Versions:
5.2.2 / 5.3.2

2. Verify Kernel TLS Support

grep 'CONFIG_SUNRPC=\|CONFIG_TLS=\|CONFIG_TLS_DEVICE=' /boot/config-$(uname -r)

Expected:

CONFIG_TLS=m
CONFIG_TLS_DEVICE=y
CONFIG_SUNRPC=m

3. Install Required Packages

Rocky / RHEL:

sudo dnf install ktls-utils nfs-utils

Ubuntu / Debian:

sudo apt install tlsh-tools nfs-common

4. Start and Verify tlshd

sudo systemctl enable --now tlshd
systemctl status tlshd

Status should show:

Active: active (running)

5. Create Certificates

1. Create domains.ext

basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = DNS:vippool-1.vast54-var.vasteng.lab,IP:172.27.54.1,IP:172.27.54.2,IP:172.27.54.3,IP:172.27.54.4,IP:172.27.54.5,IP:172.27.54.6,IP:172.27.54.7,IP:172.27.54.8

2. Generate Root CA

openssl req -x509 -nodes -new -sha256 -days 3650 \
  -newkey rsa:2048 -keyout RootCA.key -out RootCA.crt \
  -subj "/CN=Vast-Root-CA"

3. Generate Server Certificate

openssl req -new -nodes -newkey rsa:2048 \
  -keyout vast.key -out vast.csr \
  -subj "/C=IL/ST=TLV/L=TLV/O=Vast Data/CN=vms.vastdata.com"

4. Sign Server Certificate

openssl x509 -req -in vast.csr -CA RootCA.crt -CAkey RootCA.key \
  -CAcreateserial -out vast.crt -days 1024 -sha256 -extfile domains.ext

6. Verify Certificates

openssl verify -CAfile RootCA.crt vast.crt
# Expected: vast.crt: OK

openssl x509 -in vast.crt -noout -issuer
openssl x509 -in RootCA.crt -noout -subject

openssl x509 -noout -modulus -in vast.crt | openssl md5
openssl rsa -noout -modulus -in vast.key | openssl md5

7. Create Pem

cat RootCA.crt RootCA.key > RootCA.pem

8. Add certs to the VAST side

vast.crt\vast.key

9. Configure /etc/tlshd.conf

[main]
debug=0
tlsdebug=0
nl_debug=0
[authenticate.server]
[authenticate.client]
x509.truststore=/root/RootCA.pem

10. VAST Cluster Settings – NFSv3

• Path: Element Store → View Policy Configuration → NFS

• Enable Enforce TLS to encrypt traffic

• Optionally enable Relaxed TLS enforcement for mixed environments

11. VAST Cluster Settings – NFSv4

• Path: Element Store → View Policy Configuration → NFS

• Enable Enforce TLS to encrypt traffic

• Keep Relaxed TLS enforcement off unless testing

12. Mount with TLS

NFSv3:

sudo mount -o vers=3,xprtsec=tls 172.27.54.1:/nfs3tls /mnt/nfs3tls/

NFSv4:

sudo mount -o vers=4.1,xprtsec=tls 172.27.54.1:/nfs4tls /mnt/nfs4tls/

13. Debugging

Client:

journalctl -u tlshd

[root@rocky95nfstls ~]# journalctl -u tlshd
Aug 14 10:34:22 rocky95nfstls systemd[1]: Started Handshake service for kernel TLS consumers.
Aug 14 10:34:22 rocky95nfstls tlshd[4294]: Built from ktls-utils 0.11 on Mar  3 2025 00:00:00
Aug 14 10:39:47 rocky95nfstls tlshd[6415]: Handshake with 172.27.54.1 (172.27.54.1) was successful
Aug 14 11:11:35 rocky95nfstls tlshd[6472]: Handshake with 172.27.54.1 (172.27.54.1) was successful

14. Packet Capture & Verification

Capture with tcpdump:

sudo tcpdump -i <interface> -w nfs_tls.pcap

Expected Wireshark output: