Richárd Antal created PHOENIX-7976:
--------------------------------------
Summary: Introduce new parameters to support single-purpose
Extended Key Usage (EKU) certificates
Key: PHOENIX-7976
URL: https://issues.apache.org/jira/browse/PHOENIX-7976
Project: Phoenix
Issue Type: Task
Components: queryserver
Reporter: Richárd Antal
Add support single-purpose Extended Key Usage (EKU) certificates so that I can
maintain cluster security using certificates issued by public and modern
corporate CAs.
Industry standards and public CAs (specifically DigiCert) are sunsetting
multi-use certificates that contain both serverAuth and clientAuth. Currently,
CDP requires both, which will cause a "hard break" in cluster security and
connectivity by mid-2026 if not addressed.
Update validation logic to accept serverAuth-only certs for server roles and
clientAuth-only certs for mTLS roles.
--------------
To maintain compatibility assume that the current parameters are still
Dual-popuse EKU certs and introduce new parameters.
Fall back to the old parameters if the new one is not available.
Current params:
"phoenix.queryserver.tls.keystore";
"phoenix.queryserver.tls.truststore.password";
"phoenix.queryserver.tls.keystore.password";
"phoenix.queryserver.tls.truststore";
New proposed parameters:
"phoenix.queryserver.tls.server.keystore";
"phoenix.queryserver.tls.server.keystore.password";
"phoenix.queryserver.tls.server.truststore";
"phoenix.queryserver.tls.server.truststore.password";
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
