Sample manifests for TLS?

[a2geek]

I was working on enabling HTTPS/TLS for both the external communication and the peer communications...

But I got a lot of peer related errors like:

{"timestamp":"2026-06-17T18:14:35.178901233Z","level":"ERROR","fields":{"message":"TLS handshake failed: received corrupt message of type InvalidContentType","peer_addr":"10.0.4.203:55080"},"target":"rustfs::server::http","filename":"rustfs/src/server/http.rs","line_number":907,"threadName":"rustfs-worker","threadId":"ThreadId(4)"}

... I also saw some errors of the sort:

{"timestamp":"2026-06-17T18:07:02.116671215Z","level":"WARN","fields":{"message":"Evicting cached remote lock connection after RPC failure","addr":"http://a98a8c0a-a5a5-4cd9-9c1d-f717ec1a41ea.rustfs.default.rustfs.bosh:9000/var/vcap/store/rustfs-server/data0","op":"lock","reason":"code: 'Unknown error', message: \"h2 protocol error: http2 error\", source: tonic::transport::Error(Transport, hyper::Error(Http2, Error { kind: GoAway(b\"\", FRAME_SIZE_ERROR, Library) }))","resource_summary":".rustfs.sys/config/iam/sts/5IS48KOQA2ZXMANSCBSM/identity.json@latest"},"target":"rustfs_ecstore::rpc::remote_locker","filename":"crates/ecstore/src/rpc/remote_locker.rs","line_number":98,"threadName":"rustfs-worker","threadId":"ThreadId(5)"}

(note the http:// in the addr section)

My ops files are as follows:

enable-endpoint-tls.yml:

---
- type: replace
  path: /instance_groups/name=rustfs/jobs/name=rustfs-server/properties/rustfs/tls?
  value:
    certificate: |
      ((rustfs_endpoint_cert.certificate))
      ((rustfs_endpoint_ca.certificate))
    key: |
      ((rustfs_endpoint_cert.private_key))

- type: replace
  path: /variables?/-
  value:
    name: rustfs_endpoint_ca
    options:
      common_name: rustfs_endpoint_ca
      is_ca: true
    type: certificate

- type: replace
  path: /variables?/-
  value:
    name: rustfs_endpoint_cert
    options:
      alternative_names: ((rustfs_alternative_names))
      ca: rustfs_endpoint_ca
      common_name: rustfs_endpoint_cert
    type: certificate

enable-peer-tls.yml

---
- type: replace
  path: /instance_groups/name=rustfs/jobs/name=rustfs-server/properties/rustfs/peer?/tls?
  value:
    ca: |
      ((rustfs_peer_ca.certificate))
    certificate: |
      ((rustfs_peer_cert.certificate))
    key: |
      ((rustfs_peer_cert.private_key))

- type: replace
  path: /variables?/-
  value:
    name: rustfs_peer_ca
    options:
      common_name: rustfs_peer_ca
      is_ca: true
    type: certificate

- type: replace
  path: /variables?/-
  value:
    name: rustfs_peer_cert
    options:
      ca: rustfs_peer_ca
      common_name: rustfs_peer_cert
    type: certificate

The only variable is rustfs_alternative_names which is really the array of names like:

rustfs_alternative_names:
  - 's3.lan'
  - '*.s3.lan'

Curious if you've been successful and could add proper configuration?

Thanks!