Sergey Soldatov created HDDS-16034:
--------------------------------------
Summary: Certificates omit DNS SANs on clusters with non-public
hostname suffixes
Key: HDDS-16034
URL: https://issues.apache.org/jira/browse/HDDS-16034
Project: Apache Ozone
Issue Type: Bug
Components: Security
Affects Versions: 2.1.1
Reporter: Sergey Soldatov
Assignee: Sergey Soldatov
Ozone decides whether a hostname may appear as a dNSName Subject Alternative
Name by calling commons-validator's DomainValidator, which enforces the IANA
public TLD list. On clusters whose hosts use an internal suffix or a
single-label name (scm1.lxd, om.internal, datanode1) that check fails
everywhere. The CSR and self-signed-certificate builders silently drop every
DNS SAN and continue, producing IP-only certificates that fail TLS hostname
verification for by-name connections. The CA's DefaultProfile rejects any CSR
that does carry such a name, so a node requesting one cannot be certified at
all, blocking secure bootstrap.
Suggested fix: replace the public-suffix test with an RFC 1123 hostname syntax
check in a shared helper, applied symmetrically by both builders and by the CA.
Internal suffixes and single-label names become legal; malformed, wildcard, and
IP-literal values stay rejected. No new configuration key and no wire change.
Certificates on public-suffix clusters are unchanged and need no reissue.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
