Demo Configure Gossip Encryption

In this guide, you’ll secure all gossip traffic within an existing HashiCorp Consul cluster by enabling gossip encryption and message verification. By default, gossip communications are unencrypted. We’ll update each server’s agent configuration to use a shared encryption key and enable both incoming and outgoing verification.

Check Current Configuration
Enable Gossip Encryption
Validate Encryption
Links and References

1. Check Current Configuration

First, verify that your cluster is using a shared encryption key but has message verification disabled.

Consul Node	Configuration Path	Action
Node A	`/etc/consul.d/config.hcl`	Open and inspect existing settings
Node B	`/etc/consul.d/config.hcl`	Verify identical `encrypt` value

On Consul Node A

sudo vi /etc/consul.d/config.hcl

You should see an HCL block similar to:

{
  "log_level": "INFO",
  "node_name": "consul-node-a",
  "server": true,
  "ui": true,
  "leave_on_terminate": true,
  "data_dir": "/etc/consul.d/data/",
  "datacenter": "us-east-1",
  "client_addr": "0.0.0.0",
  "bind_addr": "10.0.101.110",
  "advertise_addr": "10.0.101.110",
  "retry_join": ["10.0.101.248"],
  "bootstrap_expect": 2,
  "enable_syslog": true,
  "encrypt": "62qhd/DH15Axr01MRUpMkvt53p4FAvu+FgARDUaMzA=",
  "encrypt_verify_incoming": false,
  "encrypt_verify_outgoing": false,
  "connect": { "enabled": true },
  "acl": {
    "enabled": true,
    "default_policy": "allow",
    "down_policy": "extend-cache"
  },
  "performance": { "raft_multiplier": 1 }
}

To generate or rotate a gossip encryption key, run:

consul keygen

Ensure the same key appears in every server’s encrypt field.

On Consul Node B

sudo vi /etc/consul.d/config.hcl

Confirm the encrypt value matches Node A and that both verification flags are set to false.

{
  "node_name": "consul-node-b",
  // ...
  "encrypt": "62qhd/DH15Axr01MRUpMkvt53p4FAvu+FgARDUaMzA=",
  "encrypt_verify_incoming": false,
  "encrypt_verify_outgoing": false,
  // ...
}

Restart Agents to View Current State

sudo systemctl restart consul
journalctl -u consul --no-pager | grep "Encrypt:"

Expected log output:

Encrypt: Gossip: true, TLS-Incoming: false, TLS-Outgoing: false

2. Enable Gossip Encryption

Follow two steps to fully secure gossip traffic:

Step	Flag to Enable
1	`encrypt_verify_outgoing = true`
2	`encrypt_verify_incoming = true`

Step 1: Enable Outgoing Verification

Edit each node’s config.hcl:

{
  // ... existing settings ...
  "encrypt_verify_incoming": false,
  "encrypt_verify_outgoing": true,
  // ...
}

Restart the agent:

sudo systemctl restart consul

Step 2: Enable Incoming Verification

Update both nodes again:

{
  // ... existing settings ...
  "encrypt_verify_incoming": true,
  "encrypt_verify_outgoing": true,
  // ...
}

Restart to apply changes:

sudo systemctl restart consul

Restarting the Consul agent will momentarily interrupt cluster membership. Perform these steps during a maintenance window.

3. Validate Encryption

After enabling both flags, verify the cluster membership and confirm the encryption status in logs.

3.1 Check Cluster Membership

consul members

Expected output:

Node	Address	Status	Type	Protocol	DC
consul-node-a	10.0.101.110:8301	alive	server	2	us-east-1
consul-node-b	10.0.101.248:8301	alive	server	2	us-east-1

3.2 Confirm Gossip Encryption in Logs

journalctl -u consul --no-pager | grep "Encrypt:"

Look for:

Encrypt: Gossip: true, TLS-Incoming: false, TLS-Outgoing: false

Once verified, all gossip communication is encrypted and integrity-checked. Any new agent joining the cluster must include the same encrypt key in its configuration.

Introduction

Explain Consul Architecture

Deploy a Single Datacenter

Register Services and Use Service Discovery

Access the Consul Key/Value (KV)

Back up and Restore

Register a Service Proxy

Secure Agent Communication

Secure Services with Basic ACLs

Use Gossip Encryption

HashiCorp Cloud Platform - Consul

Demo Configure Gossip Encryption

Table of Contents

1. Check Current Configuration

On Consul Node A

On Consul Node B

Restart Agents to View Current State

2. Enable Gossip Encryption

Step 1: Enable Outgoing Verification

Step 2: Enable Incoming Verification

3. Validate Encryption

3.1 Check Cluster Membership

3.2 Confirm Gossip Encryption in Logs

Links and References

Watch Video

Practice Lab

​Table of Contents

​1. Check Current Configuration

​On Consul Node A

​On Consul Node B

​Restart Agents to View Current State

​2. Enable Gossip Encryption

​Step 1: Enable Outgoing Verification

​Step 2: Enable Incoming Verification

​3. Validate Encryption

​3.1 Check Cluster Membership

​3.2 Confirm Gossip Encryption in Logs

​Links and References

Watch Video

Practice Lab

Table of Contents

1. Check Current Configuration

On Consul Node A

On Consul Node B

Restart Agents to View Current State

2. Enable Gossip Encryption

Step 1: Enable Outgoing Verification

Step 2: Enable Incoming Verification

3. Validate Encryption

3.1 Check Cluster Membership

3.2 Confirm Gossip Encryption in Logs

Links and References