[
https://issues.apache.org/jira/browse/IMPALA-15249?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18105669#comment-18105669
]
ASF subversion and git services commented on IMPALA-15249:
----------------------------------------------------------
Commit 941d244d35dbad2488a1131d5ce701e45fe3e103 in impala's branch
refs/heads/master from Jiyoung Yoo
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=941d244d3 ]
IMPALA-15249: Update test certificates to use serverAuth EKU only
Impala's test certificates in be/src/testutil/ previously had no Extended
Key Usage (EKU) extension. An absent EKU means all uses are permitted.
Industry standards and public CAs are sunsetting multi-use certificates.
To align Impala's tests with real-world PKI practices, test certificates
should use serverAuth EKU rather than dual EKU.
This change regenerates the five leaf certificate families used by
Impala's TLS tests to carry EKU=serverAuth only. Impala never presents
its certificate in a TLS client role. Every code path that loads
--ssl_server_certificate uses the cert only in the TLS server role
during the handshake, so clientAuth is intentionally omitted.
Regenerated leaves (EKU=serverAuth only):
- server-cert.pem + server-key.pem + server-key-password.pem
- localhost.pem + localhost.key
- localhost-ecdsa.pem + localhost-ecdsa.key
- wildcard-cert.pem + wildcard-cert.key
- wildcard-san-cert.pem + wildcard-san-cert.key
Not regenerated:
- CA certs: wildcardCA.pem, wildcardCA-ecdsa.pem
- Negative-path certs: bad-cert.pem, future-cert.pem,
invalid-server-cert.pem, incorrect-commonname-cert.pem
Testing:
- Existing SSL-related unit tests and E2E tests passed with the
newly generated certificates
Assisted-by: Claude Opus 5 (Claude Code)
Change-Id: Icd1e8f685db5ace524e0c705bc25eba784a1d155
Reviewed-on: http://gerrit.cloudera.org:8080/24666
Reviewed-by: Impala Public Jenkins <[email protected]>
Tested-by: Impala Public Jenkins <[email protected]>
> Update test certificates to use serverAuth EKU only
> ---------------------------------------------------
>
> Key: IMPALA-15249
> URL: https://issues.apache.org/jira/browse/IMPALA-15249
> Project: IMPALA
> Issue Type: Test
> Components: Security
> Reporter: Jiyoung Yoo
> Assignee: Jiyoung Yoo
> Priority: Minor
>
> Current test scripts in Impala use test certificates with dual Extended Key
> Usage (EKU) extensions (combining both serverAuth and clientAuth).
> Industry standards and public CAs (like DigiCert) are sunsetting multi-use
> certificates.
> To align Impala's tests with real-world PKI practices, test certificates
> should use serverAuth EKU rather than dual EKU.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
