[
https://issues.apache.org/jira/browse/PHOENIX-7976?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Richárd Antal updated PHOENIX-7976:
-----------------------------------
Description:
Add support single-purpose Extended Key Usage (EKU) certificates so that It can
maintain cluster security using certificates issued by public and modern
corporate CAs.
Industry standards and public CAs (specifically DigiCert) are sunsetting
multi-use certificates that contain both serverAuth and clientAuth.
Update validation logic to accept serverAuth-only certs for server roles and
clientAuth-only certs for mTLS roles.
--------------
To maintain compatibility assume that the current parameters are still
Dual-popuse EKU certs and introduce new parameters.
Fall back to the old parameters if the new one is not available.
Current params:
"phoenix.queryserver.tls.keystore";
"phoenix.queryserver.tls.truststore.password";
"phoenix.queryserver.tls.keystore.password";
"phoenix.queryserver.tls.truststore";
New proposed parameters:
"phoenix.queryserver.tls.server.keystore";
"phoenix.queryserver.tls.server.keystore.password";
"phoenix.queryserver.tls.server.truststore";
"phoenix.queryserver.tls.server.truststore.password";
was:
Add support single-purpose Extended Key Usage (EKU) certificates so that I can
maintain cluster security using certificates issued by public and modern
corporate CAs.
Industry standards and public CAs (specifically DigiCert) are sunsetting
multi-use certificates that contain both serverAuth and clientAuth. Currently,
CDP requires both, which will cause a "hard break" in cluster security and
connectivity by mid-2026 if not addressed.
Update validation logic to accept serverAuth-only certs for server roles and
clientAuth-only certs for mTLS roles.
--------------
To maintain compatibility assume that the current parameters are still
Dual-popuse EKU certs and introduce new parameters.
Fall back to the old parameters if the new one is not available.
Current params:
"phoenix.queryserver.tls.keystore";
"phoenix.queryserver.tls.truststore.password";
"phoenix.queryserver.tls.keystore.password";
"phoenix.queryserver.tls.truststore";
New proposed parameters:
"phoenix.queryserver.tls.server.keystore";
"phoenix.queryserver.tls.server.keystore.password";
"phoenix.queryserver.tls.server.truststore";
"phoenix.queryserver.tls.server.truststore.password";
> Introduce new parameters to support single-purpose Extended Key Usage (EKU)
> certificates
> ----------------------------------------------------------------------------------------
>
> Key: PHOENIX-7976
> URL: https://issues.apache.org/jira/browse/PHOENIX-7976
> Project: Phoenix
> Issue Type: Task
> Components: queryserver
> Reporter: Richárd Antal
> Priority: Major
>
> Add support single-purpose Extended Key Usage (EKU) certificates so that It
> can maintain cluster security using certificates issued by public and modern
> corporate CAs.
> Industry standards and public CAs (specifically DigiCert) are sunsetting
> multi-use certificates that contain both serverAuth and clientAuth.
> Update validation logic to accept serverAuth-only certs for server roles and
> clientAuth-only certs for mTLS roles.
> --------------
> To maintain compatibility assume that the current parameters are still
> Dual-popuse EKU certs and introduce new parameters.
> Fall back to the old parameters if the new one is not available.
> Current params:
> "phoenix.queryserver.tls.keystore";
> "phoenix.queryserver.tls.truststore.password";
> "phoenix.queryserver.tls.keystore.password";
> "phoenix.queryserver.tls.truststore";
> New proposed parameters:
> "phoenix.queryserver.tls.server.keystore";
> "phoenix.queryserver.tls.server.keystore.password";
> "phoenix.queryserver.tls.server.truststore";
> "phoenix.queryserver.tls.server.truststore.password";
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
