[
https://issues.apache.org/jira/browse/CASSANDRA-14223?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16479108#comment-16479108
]
Per Otterström commented on CASSANDRA-14223:
--------------------------------------------
It's fairly straight forward to create a custom TrustManager. I could create a
simplistic example to demonstrate. We're installing custom trust managers in
our deployments at Ericsson using the procedure that [[email protected]]
described above. I don't think we should invent our own way to achieve this,
when there is a standardized way.
[~ronblechman] I believe you should be able to achieve what you want using this
procedure. Rigth?
Currently it is not possible to get hostname validation (custom TrustManager or
not), but that should be solved by CASSANDRA-13404 if we agree to merge it.
[~jasobrown] I'm not sure I share your concern. A custom TrustManager could
maintain internal state, such as updating lists of revoced certificates, in a
separete thread, right? It doesn't have to happen on the
accept-thread/event-loop-thread? I will have a look at your patch to better
understand.
> Provide ability to do custom certificate validations (e.g. hostname
> validation, certificate revocation checks)
> --------------------------------------------------------------------------------------------------------------
>
> Key: CASSANDRA-14223
> URL: https://issues.apache.org/jira/browse/CASSANDRA-14223
> Project: Cassandra
> Issue Type: Improvement
> Components: Configuration
> Reporter: Ron Blechman
> Priority: Major
> Labels: security
> Fix For: 4.x
>
>
> Cassandra server should be to be able do additional certificate validations,
> such as hostname validatation and certificate revocation checking against
> CRLs and/or using OCSP.
> One approach couild be to have SSLFactory use SSLContext.getDefault() instead
> of forcing the creation of a new SSLContext using SSLContext.getInstance().
> Using the default SSLContext would allow a user to plug in their own custom
> SSLSocketFactory via the java.security properties file. The custom
> SSLSocketFactory could create a default SSLContext that was customized to do
> any extra validation such as certificate revocation, host name validation,
> etc.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
