[
https://issues.apache.org/jira/browse/HBASE-30387?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Luca Kovacs updated HBASE-30387:
--------------------------------
Description:
h2. Motivation
HBase currently only supports dual-purpose certificates. These certificate
carry both the serverAuth and clientAuth Extended Key Usages (EKUs), meaning
the same key and certificate is used whether the service running on the host is
acting as a TLS server or as a client in a mutual-TLS (mTLS) handshake.
Industry standards and public CA-s (like DigiCert) are sunsetting multi-use
certificates, making the current requirement for dual serverAuth and clientAuth
EKUs difficult to manage.
h2. Goal
Allow configuring a separate client keystore and server truststore so that
single-EKU certificates work out of the box, while maintaining full backward
compatibility when only the existing properties are set.
was:
h2. Motivation
HBase currently only supports dual-purpose certificates. These certificate
carry both the serverAuth and clientAuth Extended Key Usages (EKUs), meaning
the same key and certificate is used whether the service running on the host is
acting as a TLS server or as a client in a mutual-TLS (mTLS) handshake.
Industry standards and public CA-s (like DigiCert) are sunsetting multi-use
certificates, making the current requirement for dual serverAuth and clientAuth
EKUs difficult to manage.
h2. Goal
Allow configuring a separate client keystore and server truststore so that
single-EKU certificates work out of the box, while maintaining full backward
compatibility when only the existing keyStore.* properties are set.
> Support SingleEKU certificates
> ------------------------------
>
> Key: HBASE-30387
> URL: https://issues.apache.org/jira/browse/HBASE-30387
> Project: HBase
> Issue Type: Improvement
> Reporter: Luca Kovacs
> Assignee: Luca Kovacs
> Priority: Major
>
> h2. Motivation
> HBase currently only supports dual-purpose certificates. These certificate
> carry both the serverAuth and clientAuth Extended Key Usages (EKUs), meaning
> the same key and certificate is used whether the service running on the host
> is acting as a TLS server or as a client in a mutual-TLS (mTLS) handshake.
> Industry standards and public CA-s (like DigiCert) are sunsetting multi-use
> certificates, making the current requirement for dual serverAuth and
> clientAuth EKUs difficult to manage.
> h2. Goal
> Allow configuring a separate client keystore and server truststore so that
> single-EKU certificates work out of the box, while maintaining full backward
> compatibility when only the existing properties are set.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
