@Rocky I'm running StarRocks 4.1.1 (

4.1.1-14b7e3f

) with FE and BE in Docker. I'm trying to get Stream Load to the BE over HTTPS, but the BE web port still serves plain HTTP. be.conf

be_port = 9060
webserver_port = 8040

enable_https = true
ssl_certificate_path = /opt/starrocks/be/conf/be-cert.pem
ssl_private_key_path = /opt/starrocks/be/conf/be-key.pem

Observed • The FE (HTTPS on 8443) answers the Stream Load with a 307 redirect to

<http://172.18.0.3:8040/api/><db>/<table>/_stream_load

, so the scheme is

http

. • HTTPS to the BE fails, HTTP works:

> curl -vk <https://localhost:8040/api/health>
* schannel: next InitializeSecurityContext failed: SEC_E_INVALID_TOKEN (0x80090308)
curl: (35) schannel: next InitializeSecurityContext failed: SEC_E_INVALID_TOKEN

> curl -v <http://localhost:8040/api/health>
< HTTP/1.1 200 OK
< Content-Type: application/json
{"status": "OK","msg": "To Be Added"}

Questions 1. Does the BE HTTP server (

webserver_port

) support TLS in 4.1.x? If so, which config enables it? 2. If not, what does

enable_https

in be.conf secure (bRPC?), and is a TLS reverse proxy in front of 8040 the recommended way to encrypt Stream Load to the BE? I found the feature request #62335 (HTTPS for BE/CN HTTP ports), but it was closed as not planned, so I wanted to confirm the current status.

Based on the current StarRocks documentation and the behavior of version 4.1.1 (which aligns with the v4.0+ features), here are the answers to your questions: 1. Does the BE HTTP server support TLS in 4.1.x? No. The StarRocks BE web server (configured via

be_http_port

or

webserver_port

, default

8040

) still only supports plaintext HTTP. While StarRocks 4.0 introduced native HTTPS for the FE (on port 8443), this capability was not extended to the BE's web server. This is why you see the FE redirecting clients to an

http://

URL and why your

curl -vk https://

requests to port 8040 fail. 2. What does

enable_https

in

be.conf

secure? In the BE, the

enable_https

parameter (introduced in v4.0.0) is used specifically to enable TLS for the bRPC server. * Purpose: It secures internal inter-node communication and certain RPC-based tasks. * Mechanism: It populates

brpc::ServerOptions::ssl_options

with the certificates you provided. It does not affect the web server handling Stream Load or the Web UI. 3. Current Status & Recommendation As you noted, the feature request for native BE HTTPS (#62335) has not yet been implemented for the web server component. Recommended Workaround: To encrypt Stream Load traffic to the BE, the standard recommendation is to deploy a TLS-terminating reverse proxy (such as Nginx, HAProxy, or a Cloud Load Balancer) in front of your BE nodes: 1. Configure the proxy to listen on HTTPS (e.g., 443 or 8444). 2. Forward traffic to the BE's

be_http_port

(8040) over HTTP. 3. If using the FE's Stream Load redirect feature, ensure your network setup allows the client to reach the BEs via the proxy or directly if internal. Note on FE Redirects: Because the FE currently redirects to the BE's internal IP/HTTP port, you may need to bypass the FE redirect by sending Stream Load requests directly to the BE (via your proxy) if you require the entire path to be encrypted. You can do this by addressing the load request to the Load Balancer/Proxy URL instead of the FE. References • administration/management/BE_configuration.md • administration/user_privs/ssl_authentication.md • administration/management/FE_configuration.md • faq/Deploy_faq.md

github.com/StarRocks/starrocks/pull/62377 What is done as part of this? @Rocky

GitHub Pull Request #62377, titled "[Feature] HTTPS support for the BE/CN HTTP server ports," was an attempt to implement exactly what you are looking for: native TLS support for the BE/CN web server (typically port 8040). However, based on the repository activity: * Status: This PR was closed without being merged. * Outcome: As of StarRocks 4.1.x, the feature remains unimplemented. The PR and its associated issue (#62335) were recently closed as "not planned" or "stale," meaning there is currently no native support for HTTPS on the BE's

webserver_port

. What this PR intended to do The PR aimed to extend the

enable_https

configuration to the BE/CN's embedded web server. It proposed: 1. Allowing the BE to listen for HTTPS connections on port 8040 (or a dedicated

https_port

). 2. Using the

ssl_certificate_path

and

ssl_private_key_path

settings (which currently only apply to bRPC) for the HTTP server as well. 3. Updating the FE's redirect logic so that if the FE is accessed via HTTPS, the Stream Load 307 redirect would use the

https://

scheme for the BE. Why it isn't working for you Since this PR was not merged into the codebase, the BE web server still only initializes a plaintext HTTP handler. The

enable_https

setting in your

be.conf

is currently only utilized by the bRPC layer (internal node communication) and does not affect the web server. Current Recommendation Because native support was declined/stale, the recommended path remains using a TLS-terminating reverse proxy (like Nginx or a Cloud Load Balancer) in front of the BE nodes to handle HTTPS for Stream Load and monitoring. If you need the FE to redirect to an HTTPS URL, you may need to look into configuring the

frontend_address

or similar parameters if your proxy setup allows, though usually, users sending sensitive data via Stream Load choose to hit the BE/Proxy directly to avoid plaintext redirects.