--- title: "NFS RPC over TLS Setup and Verification Guide" slug: "nfs-rpc-over-tls-setup-and-verification-guide" description: "Set up and verify NFS RPC-over-TLS encryption for secure file sharing across supported Linux distributions." updated: 2026-10-28T18:40:50Z published: 2026-10-28T18:40:50Z canonical: "docs.vastdata.com/nfs-rpc-over-tls-setup-and-verification-guide" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt > Use this file to discover all available pages before exploring further. # NFS RPC over TLS Setup and Verification Guide ## **1. Prerequisites** **Supported Client OS:** - RHEL / Rocky / AlmaLinux ≥ 9.5 (Native NFS Client) - SLES > 15 SP5 - When using VastNFS: **vastnfs ≥ 4.5.x** ```plaintext git clone git@git.vastdata.com:kernel/mlnx-nfsrdma.git cd mlnx-nfsrdma git checkout origin/next/4.5.x ``` **Cluster Setting:** ```plaintext vtool vsettings set NFS_ALLOW_TLS_1_3=true ``` **Vast Versions:** 5.2.2 / 5.3.2 ## **2. Verify Kernel TLS Support** ```plaintext grep 'CONFIG_SUNRPC=\|CONFIG_TLS=\|CONFIG_TLS_DEVICE=' /boot/config-$(uname -r) ``` Expected: ```plaintext CONFIG_TLS=m CONFIG_TLS_DEVICE=y CONFIG_SUNRPC=m ``` ## **3. Install Required Packages** **Rocky / RHEL:** ```plaintext sudo dnf install ktls-utils nfs-utils ``` **Ubuntu / Debian:** ```plaintext sudo apt install tlsh-tools nfs-common ``` ## **4. Start and Verify tlshd** ```plaintext sudo systemctl enable --now tlshd systemctl status tlshd ``` Status should show: ```plaintext Active: active (running) ``` ## **5. Create Certificates** 1. **Create domains.ext** ```plaintext basicConstraints=CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment subjectAltName = DNS:vippool-1.vast54-var.vasteng.lab,IP:172.27.54.1,IP:172.27.54.2,IP:172.27.54.3,IP:172.27.54.4,IP:172.27.54.5,IP:172.27.54.6,IP:172.27.54.7,IP:172.27.54.8 ``` 1. **Generate Root CA** ```plaintext openssl req -x509 -nodes -new -sha256 -days 3650 \  -newkey rsa:2048 -keyout RootCA.key -out RootCA.crt \  -subj "/CN=Vast-Root-CA" ``` 1. **Generate Server Certificate** ```plaintext openssl req -new -nodes -newkey rsa:2048 \  -keyout vast.key -out vast.csr \  -subj "/C=IL/ST=TLV/L=TLV/O=Vast Data/CN=vms.vastdata.com" ``` 1. **Sign Server Certificate** ```plaintext openssl x509 -req -in vast.csr -CA RootCA.crt -CAkey RootCA.key \  -CAcreateserial -out vast.crt -days 1024 -sha256 -extfile domains.ext ``` ## **6. Verify Certificates** ```plaintext openssl verify -CAfile RootCA.crt vast.crt # Expected: vast.crt: OK openssl x509 -in vast.crt -noout -issuer openssl x509 -in RootCA.crt -noout -subject openssl x509 -noout -modulus -in vast.crt | openssl md5 openssl rsa -noout -modulus -in vast.key | openssl md5 ``` ## **7. Create Pem** ```plaintext cat RootCA.crt RootCA.key > RootCA.pem ``` ## **8. Add certs to the VAST side** **vast.crt\vast.key** ![The screenshot shows the Certificates management page within VAST, where users can paste and upload certificates and keys to secure NFS access. The interface includes fields for entering certificate content and key data, with reminders indicating that extra certificates are already set.](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/aa75cc8a-079d-47b1-9051-009bf1dea397.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A16%3A44Z&se=2026-11-08T10%3A16%3A44Z&sr=c&sp=r&sig=fjbGRMN05Z%2FQ8m5AXMjamztu0cOo3GtpySRZfA1kFZQ%3D) Add certs to the VAST side ## **9. Configure /etc/tlshd.conf** ```plaintext [main] debug=0 tlsdebug=0 nl_debug=0 [authenticate.server] [authenticate.client] x509.truststore=/root/RootCA.pem ``` ## **10. VAST Cluster Settings – NFSv3** - Path: Element Store → View Policy Configuration → NFS - Enable **Enforce TLS to encrypt traffic** - Optionally enable **Relaxed TLS enforcement** for mixed environments ![The image depicts the NFS configuration settings within a policy management interface, where options such as Group membership source (NFS RPC), TLS enforcement settings, and Kerberos Authentication Minimal protection level can be configured. This screenshot highlights advanced NFS protocol configurations that include enabling or disabling features like POSIX ACLs, 32-bit File IDs, and case sensitivity in NFSv4, along with setting the minimum security level required for NFSv5 client mounts.](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/a1ef8718-6784-4614-b630-df488a8e280a.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A16%3A44Z&se=2026-11-08T10%3A16%3A44Z&sr=c&sp=r&sig=fjbGRMN05Z%2FQ8m5AXMjamztu0cOo3GtpySRZfA1kFZQ%3D) Enforce TLS to encrypt traffic ## **11. VAST Cluster Settings – NFSv4** - Path: Element Store → View Policy Configuration → NFS - Enable **Enforce TLS to encrypt traffic** - Keep **Relaxed TLS enforcement** off unless testing ![The image displays the NFS policy configuration screen within an advanced storage management interface, where settings such as TLS encryption enforcement and Kerberos authentication protection level can be configured to ensure secure file sharing over NFS protocols.](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/7dd36a5e-0371-47f1-8da8-c5b53996d4db.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A16%3A44Z&se=2026-11-08T10%3A16%3A44Z&sr=c&sp=r&sig=fjbGRMN05Z%2FQ8m5AXMjamztu0cOo3GtpySRZfA1kFZQ%3D) Enforce TLS to encrypt traffic ## **12. Mount with TLS** **NFSv3:** ```plaintext sudo mount -o vers=3,xprtsec=tls 172.27.54.1:/nfs3tls /mnt/nfs3tls/ ``` **NFSv4:** ```plaintext sudo mount -o vers=4.1,xprtsec=tls 172.27.54.1:/nfs4tls /mnt/nfs4tls/ ``` ## **13. Debugging** Client: ```plaintext journalctl -u tlshd ``` ```plaintext [root@rocky95nfstls ~]# journalctl -u tlshd Aug 14 10:34:22 rocky95nfstls systemd[1]: Started Handshake service for kernel TLS consumers. Aug 14 10:34:22 rocky95nfstls tlshd[4294]: Built from ktls-utils 0.11 on Mar  3 2025 00:00:00 Aug 14 10:39:47 rocky95nfstls tlshd[6415]: Handshake with 172.27.54.1 (172.27.54.1) was successful Aug 14 11:11:35 rocky95nfstls tlshd[6472]: Handshake with 172.27.54.1 (172.27.54.1) was successful ``` ## **14. Packet Capture & Verification** **Capture with tcpdump:** ```plaintext sudo tcpdump -i -w nfs_tls.pcap ``` **Expected Wireshark output:** ![The screenshot displays a network capture using Wireshark, showing TLSv1.2 protocol data exchanged between sources and destinations on various IP addresses, with each packet containing 192 bytes of application data.](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/5f9fbd26-953e-4716-bdd3-eb7d08e62ae3.png?sv=2026-02-06&spr=https&st=2026-11-08T09%3A16%3A44Z&se=2026-11-08T10%3A16%3A44Z&sr=c&sp=r&sig=fjbGRMN05Z%2FQ8m5AXMjamztu0cOo3GtpySRZfA1kFZQ%3D) Expected Wireshark output