[
https://issues.apache.org/jira/browse/PHOENIX-7976?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dávid Paksy reassigned PHOENIX-7976:
------------------------------------
Assignee: Dávid Paksy
> Introduce new parameters to support single-purpose Extended Key Usage (EKU)
> certificates
> ----------------------------------------------------------------------------------------
>
> Key: PHOENIX-7976
> URL: https://issues.apache.org/jira/browse/PHOENIX-7976
> Project: Phoenix
> Issue Type: Task
> Components: queryserver
> Reporter: Richárd Antal
> Assignee: Dávid Paksy
> Priority: Major
>
> Add support single-purpose Extended Key Usage (EKU) certificates so that It
> can maintain cluster security using certificates issued by public and modern
> corporate CAs.
> Industry standards and public CAs (specifically DigiCert) are sunsetting
> multi-use certificates that contain both serverAuth and clientAuth.
> Update validation logic to accept serverAuth-only certs for server roles and
> clientAuth-only certs for mTLS roles.
> --------------
> To maintain compatibility assume that the current parameters are still
> Dual-popuse EKU certs and introduce new parameters.
> Fall back to the old parameters if the new one is not available.
> Current params:
> "phoenix.queryserver.tls.keystore";
> "phoenix.queryserver.tls.truststore.password";
> "phoenix.queryserver.tls.keystore.password";
> "phoenix.queryserver.tls.truststore";
> New proposed parameters:
> "phoenix.queryserver.tls.server.keystore";
> "phoenix.queryserver.tls.server.keystore.password";
> "phoenix.queryserver.tls.server.truststore";
> "phoenix.queryserver.tls.server.truststore.password";
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
