# Encryption in Transit (Continue...)

+ **`[security]`** configuration for `TiKV/PD`
  + Certificate files path
  + Caller identity verification
+ For example:

```
~!@[security]@!~
~!@## The path for certificates. An empty string means that secure connections are disabled.@!~
# Path of the file that contains a list of trusted SSL CAs. If it is set, the following settings `cert_path` and `key_path` are also needed.
~!@cacert-path@!~ = "/path/to/ca.pem"
# Path of the file that contains X509 certificate in PEM format.
~!@cert-path@~ = "/path/to/pd-server.pem"
# Path of the file that contains X509 key in PEM format.
~!@key-path@!~ = "/path/to/pd-server-key.pem"
...

~!@[security]@!~
~!@## TiKV@!~
cert-allowed-cn = [
    "TiDB-Server", "PD-Server", "TiKV-Control", "RawKvClient1",
]
...

~!@[security]@!~
~!@## PD@!~
cert-allowed-cn = ["TiKV-Server", "TiDB-Server", "PD-Control"]
```

------------------------------------------------------------