nevzheng opened a new issue, #12303:
URL: https://github.com/apache/gravitino/issues/12303
### Describe the subtask
The completeness milestone — closing the two journeys the core work leaves
open.
**Policy constraints.** The configurer contract carries protocol and
cipher-suite restrictions, but the helper doesn't expose them — so a
deployment
that must enforce TLS 1.3 today has to hand-implement the interface.
Compliance
requirements shouldn't demand custom code.
**System-truststore mTLS.** The helper requires an explicit truststore. A
client
talking to a server with a publicly-trusted certificate, while presenting its
own client certificate, has no way to say "default trust, my keystore." That
combination is currently inexpressible through the helper.
## Deliverable
- Protocol and cipher-suite configuration through the helper, not only via
the
interface.
- A keystore-only path: client certificate with the platform's default trust.
## Acceptance criteria
- [ ] A deployment can enforce TLS 1.3 (or a cipher list) through the helper
alone
- [ ] A test proves the constraint binds: a handshake outside the permitted
protocols actually fails
- [ ] Client-cert-with-default-trust is expressible and tested against a
trusted server certificate
- [ ] Docs updated for both
Depends on: M3 (and M4 if the helper surface moves).
### Parent issue
#9836
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
