| <table class="configuration table table-bordered"> |
| <thead> |
| <tr> |
| <th class="text-left" style="width: 20%">Key</th> |
| <th class="text-left" style="width: 15%">Default</th> |
| <th class="text-left" style="width: 10%">Type</th> |
| <th class="text-left" style="width: 55%">Description</th> |
| </tr> |
| </thead> |
| <tbody> |
| <tr> |
| <td><h5>security.ssl.internal.close-notify-flush-timeout</h5></td> |
| <td style="word-wrap: break-word;">-1</td> |
| <td>Integer</td> |
| <td>The timeout (in ms) for flushing the `close_notify` that was triggered by closing a channel. If the `close_notify` was not flushed in the given timeout the channel will be closed forcibly. (-1 = use system default)</td> |
| </tr> |
| <tr> |
| <td><h5>security.ssl.internal.handshake-timeout</h5></td> |
| <td style="word-wrap: break-word;">-1</td> |
| <td>Integer</td> |
| <td>The timeout (in ms) during SSL handshake. (-1 = use system default)</td> |
| </tr> |
| <tr> |
| <td><h5>security.ssl.internal.session-cache-size</h5></td> |
| <td style="word-wrap: break-word;">-1</td> |
| <td>Integer</td> |
| <td>The size of the cache used for storing SSL session objects. According to <a href="https://github.com/netty/netty/issues/832">here</a>, you should always set this to an appropriate number to not run into a bug with stalling IO threads during garbage collection. (-1 = use system default).</td> |
| </tr> |
| <tr> |
| <td><h5>security.ssl.internal.session-timeout</h5></td> |
| <td style="word-wrap: break-word;">-1</td> |
| <td>Integer</td> |
| <td>The timeout (in ms) for the cached SSL session objects. (-1 = use system default)</td> |
| </tr> |
| <tr> |
| <td><h5>security.ssl.provider</h5></td> |
| <td style="word-wrap: break-word;">"JDK"</td> |
| <td>String</td> |
| <td>The SSL engine provider to use for the ssl transport:<ul><li><code class="highlighter-rouge">JDK</code>: default Java-based SSL engine</li><li><code class="highlighter-rouge">OPENSSL</code>: openSSL-based SSL engine using system libraries</li></ul><code class="highlighter-rouge">OPENSSL</code> is based on <a href="http://netty.io/wiki/forked-tomcat-native.html#wiki-h2-4">netty-tcnative</a> and comes in two flavours:<ul><li>dynamically linked: This will use your system's openSSL libraries (if compatible) and requires <code class="highlighter-rouge">opt/flink-shaded-netty-tcnative-dynamic-*.jar</code> to be copied to <code class="highlighter-rouge">lib/</code></li><li>statically linked: Due to potential licensing issues with openSSL (see <a href="https://issues.apache.org/jira/browse/LEGAL-393">LEGAL-393</a>), we cannot ship pre-built libraries. However, you can build the required library yourself and put it into <code class="highlighter-rouge">lib/</code>:<br /><code class="highlighter-rouge">git clone https://github.com/apache/flink-shaded.git && cd flink-shaded && mvn clean package -Pinclude-netty-tcnative-static -pl flink-shaded-netty-tcnative-static</code></li></ul></td> |
| </tr> |
| </tbody> |
| </table> |
