SSL Whitelisting
Gallium Edge uses TLS encryption for all traffic between the hypervisor on your server and the Gallium Console. If your server sits behind a firewall or proxy that performs SSL inspection, that device intercepts and re-signs TLS connections, which breaks the hypervisor's ability to reach the Console. To keep everything working, whitelist the endpoints and addresses below so this traffic bypasses SSL inspection.
Most networks do not need any of this. These steps are only relevant when an SSL-inspecting firewall or proxy sits between your server and the internet. If you are troubleshooting a server that cannot connect during or after installation, see Installing Gallium Edge.
Required Domains
Allow outbound access to the following domains and exempt them from SSL inspection.
| Domain | Purpose |
|---|---|
api.gallium.cloud | Primary API service endpoint |
relay.gallium.cloud | Remote VM console relay service |
us-k1.gallium-relay.com | United States K1 regional relay |
us-k2.gallium-relay.com | United States K2 regional relay |
eu-1.gallium-relay.com | Europe region 1 relay |
au-1.gallium-relay.com | Australia region 1 relay |
gallium.b-cdn.net | Content delivery network for assets |
IP Addresses
Where your firewall filters by address rather than domain, allow outbound connections to these IP addresses:
137.184.44.15141.95.127.134
Encryption Standards
The Gallium Edge hypervisor negotiates connections using:
- TLS 1.3
- One of the following cipher suites:
TLS_AES_128_GCM_SHA256TLS_AES_256_GCM_SHA384TLS_CHACHA20_POLY1305_SHA256
An SSL-inspecting device typically substitutes its own certificate and may downgrade or renegotiate the cipher suite. If you cannot exempt Gallium traffic from inspection, the hypervisor will be unable to establish a secure connection. Bypassing inspection for the endpoints above is the supported configuration.
TLS certificate validation also depends on an accurate clock. If connections still fail after whitelisting, confirm the server's BIOS clock is set to the correct date and time, since a skewed clock causes certificate validation to fail.