title: Service Fabric remoting secure transport certificate
body: <p>I use Service Remoting to call actors in Service Fabric. These calls to actors are made from stateless services within the Service Fabric cluster and also from other actors within the Service Fabric cluster. I would like to make sure that the transport of these Service Remoting calls over the network is encrypted so that messages cannot be intercepted on the network and read. Transport security is not to be confused with authentication and authorization of the calls (for which client certificates are used?).</p>
  <p>I am confused about which certificate or certificates to use and how to configure them. The Microsoft documentation <a href="https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-reliable-actors-fabrictransportsettings" rel="nofollow noreferrer">here</a> seems to suggest two separate certificates are used for the client and the listener, where you configure the local certificate to find and also configure the certificate remote thumbprint(s) or certificate remote common name(s) for the client or listener, where the client specifies the listener as the remote and the listener specifies the client as the remote.</p>
  <p>Why is it necessary to use two separate certificates when the client and listener are all services within the same SF cluster, especially when actors call other actors so that actors are both client and listener? Can we use a single certificate for both client and listener?</p>
  <p>Do we have to specify remote thumbprints or remote common names or is that optional?</p>
  <p>Which certificate should we use: a dedicated certificate for transport security, or the same certificate we have for encrypting secrets in Service Fabric, or perhaps the client, server or cluster certificate used for authentication?</p>
  <p>Update 2021-10-18
  I found that you can configure a ClusterProtectionLevel setting as follows</p>
  <pre><code>               &quot;fabricSettings&quot;: [
                  {
                      &quot;parameters&quot;: [
                          {
                              &quot;name&quot;: &quot;ClusterProtectionLevel&quot;,
                              &quot;value&quot;: &quot;EncryptAndSign&quot;
                          }
                      ],
                      &quot;name&quot;: &quot;Security&quot;
                  }
              ],
  </code></pre>
  <p>However, it is unclear what the default is when you do not specify this setting, nor if this setting also applies to Service Remoting calls. Can anybody clarify this?</p>
  <p>Also, we run our services as local user accounts and these local user accounts (that are created and managed by Service Fabric) need permission on the server certificate to be able make Service Remoting calls. I know when specifying a secrets certificate in the application manifest you can declare the local users that need permissions on the secrets certificate through a SecurityAccessPolicy and Service Fabric will automatically set the permissions for the local user accounts on the secrets certificate in the certificate store on all nodes. But it is unclear how the same can be done automatically for permissions on the server certificate for the local user accounts that need to make Service Remoting calls. The application manifest also allows declaring endpoint certificates, but it is unclear whether this only applies to http endpoints, or also Service Remoting endpoints. Can anybody clarify this?</p>