TLS - Teradata Fabric

Teradata® Fabric - Installation and User Guide - 3.11
Product
Teradata Fabric
Release Number
3.11
Published
August 2026
ft:locale
en-US
ft:lastEdition
2026-08-15
dita:mapPath
svw1780362788070.ditamap
dita:ditavalPath
ezw1784752870623.ditaval
dita:id
lxg1591800469257

Arrow Flight clients and servers require TLS for all communication in production environments.

Deployment TLS Configuration
Teradata Cloud Support certificates from a customer private CA or self-signed certificates
Cloud (AWS) through ALB
  • External-facing connections require a public certificate on the Application Load Balancer (ALB)
  • The internal connection between the ALB and the Arrow Flight SQL Connector (SERVER Execution Type) nodes use certificates from internal certificate authority
  • AWS ALB does not validate private certificates from the connector nodes but provides security through traffic whitelisting
Cloud (Azure) Not supported
Cloud (Google Cloud)
  • External-facing connections require a public certificate on the Application Load Balancer (ALB)
  • The internal connection between the ALB and the Arrow Flight SQL Connector (SERVER Execution Type) nodes use certificates from internal certificate authority
  • Google cloud ALB does not validate private certificates from the connector nodes but provides security through traffic whitelisting

The following TLS-related connector properties apply to the SERVER execution type:

Setting Description
Auth Token Encryption Key Specifies a user-defined random string used to encrypt and decrypt authentication tokens for secure storage. For stronger security, use at least 12 characters, including uppercase letters, lowercase letters, and numbers

Required for the SERVER execution type
Flight Server TLS Cert Refresh (Days) Specifies the number of days before certificate expiration when the server attempts to refresh the certificate

Default: 7

Minimum: 5

Maximum: 60