[
https://issues.apache.org/jira/browse/CASSCPP-16?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18108661#comment-18108661
]
Bret McGuire commented on CASSCPP-16:
-------------------------------------
I've got a working branch that appears to be connecting via TLS 1.3 (based on
wireshark) but isn't really working yet. After appearing to connect my test
client stalls and eventually times out without doing anything. I haven't dug
into this in detail yet so for now I'm just posting my test client (and
relevant Cassandra 5.0.x configs) in case anybody else wants to try and repro.
{noformat}
keytool -genkeypair -noprompt -keyalg RSA -validity 36500 -alias node
-keystore ~/.ccm/cass-504ssl-1/node1/conf/keystore -storepass cassandra
-keypass cassandra -dname "CN=127.0.0.1 OU=Drivers and Tools, O=DataStax
Inc., L=Santa Clara, ST=California, C=US"
{noformat}
{noformat}
client_encryption_options:
enabled: true
optional: false
keystore: /path/to/cassandra/conf/keystore
keystore_password: cassandra
require_client_auth: false
protocol: TLSv1.3
{noformat}
For sake of completeness I'm using libuv 1.51.0 and OpenSSL 3.5.4 on Debian
13.0. Apache Cassandra I'm testing against is 5.0.4.
> Revisit support for TLS 1.3
> ---------------------------
>
> Key: CASSCPP-16
> URL: https://issues.apache.org/jira/browse/CASSCPP-16
> Project: Apache Cassandra C/C++ driver
> Issue Type: Improvement
> Components: Core
> Reporter: Bret McGuire
> Priority: Normal
> Time Spent: 10m
> Remaining Estimate: 0h
>
> 2.17.1 caps the supported TLS version at 1.2 rather than 1.3 (see
> [here|https://github.com/apache/cassandra-cpp-driver/blob/2.17.1/src/ssl/ssl_openssl_impl.cpp#L541-L544]).
> This was apparently a consequence of work done on
> [CPP-786|https://datastax-oss.atlassian.net/browse/CPP-786] and
> [CPP-922|https://datastax-oss.atlassian.net/browse/CPP-922]. The trail seems
> to indicate that the problem was that a recent Ubuntu release had broken
> mockssandra.
> Good news is that a lot has changed since then. It's worthwhile taking
> another look at tHis to see if we're still stuck. Apache Cassandra 5.0.x has
> introduced explicit support for TLS 1.3 so we should be able to test directly
> in integration tests rather than rely on mockssandra.
> This issue was prompted by a series of question raised by Chintan Pansuriya
> in [a
> question|https://lists.apache.org/thread/66scpszqprgn9v16ronfflnlx731hkk0]
> sent to dev@.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
