adoroszlai opened a new pull request, #10906:
URL: https://github.com/apache/ozone/pull/10906

   ## What changes were proposed in this pull request?
   
   Certificate sign requests should include hostname even if it does not have 
proper TLD (e.g. `scm` in Docker Compose environment).  Otherwise certificate 
host name validation will fail:
   
   ```
   Caused by: javax.net.ssl.SSLHandshakeException: General OpenSslEngine problem
   ...
   Caused by: java.security.cert.CertificateException: No name matching scm 
found for SNIHostName=null and peerHost=scm in the chain of 2 certificate(s): 
1. subjectAlternativeNames=[IP:172.18.0.18], CN=scm-sub@scm. 2. 
subjectAlternativeNames=[IP:172.18.0.18], CN=scm@scm.
   ...
   Caused by: java.security.cert.CertificateException: No name matching scm 
found
   ```
   
   after upgrade to Netty 4.1.135 
(https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9).
   
   https://issues.apache.org/jira/browse/HDDS-16030
   
   ## How was this patch tested?
   
   https://github.com/adoroszlai/ozone/actions/runs/30532333980
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to