This is an automated email from the ASF dual-hosted git repository.
richardantal pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/phoenix-queryserver.git
The following commit(s) were added to refs/heads/master by this push:
new b8a4a44 PHOENIX-7976: Introduce new parameters to support
single-purpose Extended Key Usage (EKU) certificates (#194)
b8a4a44 is described below
commit b8a4a44dfdd41099ec091d0e2a0823860af3f8ad
Author: Dávid Paksy <[email protected]>
AuthorDate: Wed Sep 2 15:06:57 2026 +0200
PHOENIX-7976: Introduce new parameters to support single-purpose Extended
Key Usage (EKU) certificates (#194)
To maintain compatibility assume that the current parameters are still
Dual-purpose EKU certs and introduce new parameters.
Fall back to the old parameters if the new one is not available.
Current params:
"phoenix.queryserver.tls.keystore";
"phoenix.queryserver.tls.truststore.password";
"phoenix.queryserver.tls.keystore.password";
"phoenix.queryserver.tls.truststore";
New proposed parameters:
"phoenix.queryserver.tls.server.keystore";
"phoenix.queryserver.tls.server.keystore.password";
"phoenix.queryserver.tls.server.truststore";
"phoenix.queryserver.tls.server.truststore.password";
---
.../phoenix/end2end/QueryServerEnvironment.java | 8 ++++----
.../phoenix/queryserver/QueryServerProperties.java | 8 ++++++++
.../phoenix/queryserver/server/QueryServer.java | 24 ++++++++++++++++++----
3 files changed, 32 insertions(+), 8 deletions(-)
diff --git
a/phoenix-queryserver-it/src/it/java/org/apache/phoenix/end2end/QueryServerEnvironment.java
b/phoenix-queryserver-it/src/it/java/org/apache/phoenix/end2end/QueryServerEnvironment.java
index 8e5b068..b986c80 100644
---
a/phoenix-queryserver-it/src/it/java/org/apache/phoenix/end2end/QueryServerEnvironment.java
+++
b/phoenix-queryserver-it/src/it/java/org/apache/phoenix/end2end/QueryServerEnvironment.java
@@ -236,13 +236,13 @@ public class QueryServerEnvironment {
if (tls) {
conf.setBoolean(QueryServerProperties.QUERY_SERVER_TLS_ENABLED,
true);
- conf.set(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE,
+ conf.set(QueryServerProperties.QUERY_SERVER_TLS_SERVER_KEYSTORE,
TlsUtil.getKeyStoreFile().getAbsolutePath());
- conf.set(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_PASSWORD,
+
conf.set(QueryServerProperties.QUERY_SERVER_TLS_SERVER_KEYSTORE_PASSWORD,
TlsUtil.getKeyStorePassword());
- conf.set(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE,
+ conf.set(QueryServerProperties.QUERY_SERVER_TLS_SERVER_TRUSTSTORE,
TlsUtil.getTrustStoreFile().getAbsolutePath());
-
conf.set(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD,
+
conf.set(QueryServerProperties.QUERY_SERVER_TLS_SERVER_TRUSTSTORE_PASSWORD,
TlsUtil.getTrustStorePassword());
}
diff --git
a/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/QueryServerProperties.java
b/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/QueryServerProperties.java
index 3b23e20..21cae81 100644
---
a/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/QueryServerProperties.java
+++
b/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/QueryServerProperties.java
@@ -66,12 +66,20 @@ public class QueryServerProperties {
"phoenix.queryserver.tls.enabled";
public static final String QUERY_SERVER_TLS_KEYSTORE =
"phoenix.queryserver.tls.keystore";
+ public static final String QUERY_SERVER_TLS_SERVER_KEYSTORE =
+ "phoenix.queryserver.tls.server.keystore";
public static final String QUERY_SERVER_TLS_KEYSTORE_PASSWORD =
"phoenix.queryserver.tls.keystore.password";
+ public static final String QUERY_SERVER_TLS_SERVER_KEYSTORE_PASSWORD =
+ "phoenix.queryserver.tls.server.keystore.password";
public static final String QUERY_SERVER_TLS_TRUSTSTORE =
"phoenix.queryserver.tls.truststore";
+ public static final String QUERY_SERVER_TLS_SERVER_TRUSTSTORE =
+ "phoenix.queryserver.tls.server.truststore";
public static final String QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD =
"phoenix.queryserver.tls.truststore.password";
+ public static final String QUERY_SERVER_TLS_SERVER_TRUSTSTORE_PASSWORD =
+ "phoenix.queryserver.tls.server.truststore.password";
public static final String QUERY_SERVER_TLS_ENABLED_PROTCOLS =
"phoenix.queryserver.tls.protocols";
public static final String QUERY_SERVER_TLS_ENABLED_CIPHERSUITES =
diff --git
a/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/server/QueryServer.java
b/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/server/QueryServer.java
index de5ef58..7120b67 100644
---
a/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/server/QueryServer.java
+++
b/phoenix-queryserver/src/main/java/org/apache/phoenix/queryserver/server/QueryServer.java
@@ -283,12 +283,28 @@ public final class QueryServer extends Configured
implements Tool, Runnable {
private void setTlsIfNeccessary(Builder<Server> builder, Configuration conf)
throws Exception {
final boolean useTls =
getConf().getBoolean(QueryServerProperties.QUERY_SERVER_TLS_ENABLED,
QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_ENABLED);
if(useTls) {
- final String tlsKeystore =
getConf().get(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE);
final String keystoreType =
getConf().get(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_TYPE_KEY,
QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_TYPE_DEFAULT);
- final String tlsKeystorePassword =
getConf().get(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_PASSWORD,
QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_KEYSTORE_PASSWORD);
- final String tlsTruststore =
getConf().get(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE);
- final String tlsTruststorePassword =
getConf().get(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD,
QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD);
+ String tlsKeystore =
getConf().get(QueryServerProperties.QUERY_SERVER_TLS_SERVER_KEYSTORE);
+ if (tlsKeystore == null){
+ tlsKeystore =
getConf().get(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE);
+ }
+
+ String tlsKeystorePassword =
getConf().get(QueryServerProperties.QUERY_SERVER_TLS_SERVER_KEYSTORE_PASSWORD,
QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_KEYSTORE_PASSWORD);
+ if (tlsKeystorePassword == null ||
tlsKeystorePassword.equals(QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_KEYSTORE_PASSWORD))
{
+ tlsKeystorePassword =
getConf().get(QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE_PASSWORD,
QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_KEYSTORE_PASSWORD);
+ }
+
+ String tlsTruststore =
getConf().get(QueryServerProperties.QUERY_SERVER_TLS_SERVER_TRUSTSTORE);
+ if (tlsTruststore == null){
+ tlsTruststore =
getConf().get(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE);
+ }
+
+ String tlsTruststorePassword =
getConf().get(QueryServerProperties.QUERY_SERVER_TLS_SERVER_TRUSTSTORE_PASSWORD,
QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD);
+ if (tlsTruststorePassword == null ||
tlsTruststorePassword.equals(QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD))
{
+ tlsTruststorePassword =
getConf().get(QueryServerProperties.QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD,
QueryServerOptions.DEFAULT_QUERY_SERVER_TLS_TRUSTSTORE_PASSWORD);
+ }
+
if(tlsKeystore == null) {
throw new Exception(String.format("if %s is enabled, %s must be
specfified" , QueryServerProperties.QUERY_SERVER_TLS_ENABLED,
QueryServerProperties.QUERY_SERVER_TLS_KEYSTORE));
}
