v.20.12Improvement

Enable SNI Connection for Clickhouse Server Secure Endpoint Behind TLS Proxy

Official CH changelog text
Make it possible to connect to clickhouse-server secure endpoint which requires SNI. This is possible when clickhouse-server is hosted behind TLS proxy. #16938 (filimonov).
Added support for connecting to clickhouse-server TLS endpoints requiring Server Name Indication (SNI), enabling secure connections when clickhouse-server is hosted behind a TLS proxy.

Why it matters

This feature addresses the need to connect securely to clickhouse-server instances that are hosted behind TLS proxies requiring SNI. It ensures that clients can specify the server name during the TLS handshake, which is essential for correct routing and security in environments using SNI-enabled proxies.

How to use it

To use this feature, configure the client connection to specify the appropriate server name for SNI when connecting to a clickhouse-server endpoint secured by a TLS proxy. This typically involves setting the server name parameter in the TLS settings of the ClickHouse client or driver used to establish the connection.

Related resources

PreviousNext