[
https://issues.apache.org/jira/browse/CASSANDRA-18124?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17704370#comment-17704370
]
Maulin Vasavada edited comment on CASSANDRA-18124 at 3/23/23 9:39 PM:
----------------------------------------------------------------------
Thanks [~rtib] for the review. I can update the cassandra yaml to have the PEM
example in comments. Also I'll try to check on the Nodetool output. I fixed the
issue of getting truststore warning for the PEM and made truststore password
also nullable but this warning I need to check. Earlier it came because of
defaults and the fallback of `key_password` to `keystore_password` in the
absence of the prior, now it could be the same reason.
One option is - avoid logging a warning in case both the values are same since
technically it doesn't create any issue ONLY in case they are different we
should log a warning. What do you think?
Meanwhile [~smiklosovic] can we get any additional PR reviews to have more eyes
on this ?
was (Author: maulin.vasavada):
Thanks [~rtib] for the review. I can update the cassandra yaml to have the PEM
example in comments. Also I'll try to check on the Nodetool output. I fixed the
issue of getting truststore warning for the PEM and made truststore password
also nullable but this warning I need to check. Earlier it came because of
defaults and the fallback of `key_password` to `keystore_password` in the
absence of the prior, now it could be the same reason. Meanwhile [~smiklosovic]
can we get any additional PR reviews to have more eyes on this ?
> Config parameter keystore_password should be nullable
> -----------------------------------------------------
>
> Key: CASSANDRA-18124
> URL: https://issues.apache.org/jira/browse/CASSANDRA-18124
> Project: Cassandra
> Issue Type: Bug
> Components: Local/Config
> Reporter: Tibor Repasi
> Assignee: Maulin Vasavada
> Priority: Normal
> Fix For: 4.1.x, 5.x
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Some SSL configuration may pass unencrypted private keys. PEMReader might
> accept that by assuming keyPassword to be null in that case (e.g.
> https://github.com/apache/cassandra/blob/f9e033f519c14596da4dc954875756a69aea4e78/src/java/org/apache/cassandra/security/PEMReader.java#L103).
> Current configuration reader does not accept keystore_password parameter to
> be set null or empty in the cassandra.yaml.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
