# Encryption in Transit 

+ Certificate generation
  + Support self-signed certificate with tools like **`openssl`**, **`easy-rsa`**, **`cfssl`**
    + E.g: **`openssl req -new -x509 -days 90 -key root.key -out root.crt`**
  + Recommend to generate different certificates for `PD` and `TiKV`
+ Support certificate reload on-the-fly
+ `CA` cannot be reloaded

------------------------------------------------------------