Siyao Meng created HDDS-17542:
---------------------------------
Summary: Ozone HTTPS endpoints only accept TLSv1.2 by default
Key: HDDS-17542
URL: https://issues.apache.org/jira/browse/HDDS-17542
Project: Apache Ozone
Issue Type: Bug
Components: Security, server-framework
Reporter: Siyao Meng
Since HDDS-15152, {{HttpServer2}} always applies the configured enabled
protocols to Jetty. When {{ozone.ssl.enabled.protocols}} is not set, it falls
back to {{hadoop.ssl.enabled.protocols}}, which {{core-default.xml}} sets to
{{TLSv1.2}}. So with no SSL protocol configuration at all, the S3 Gateway and
all component web UIs reject TLSv1.3 and only negotiate TLSv1.2. Before
HDDS-10819, Jetty's defaults (TLSv1.2 and TLSv1.3) were used.
Reproduce: start S3 Gateway with HTTPS and no {{*.ssl.enabled.protocols}}
settings, then connect with a TLSv1.3-only client:
{code}
openssl s_client -connect <s3g-host>:9879 -tls1_3
{code}
The handshake fails with {{protocol_version}}. A client offering both versions
negotiates TLSv1.2.
Proposed fix: use {{hadoop.ssl.enabled.protocols}} only when it is explicitly
configured (not just inherited from {{core-default.xml}}), otherwise default to
{{TLSv1.2,TLSv1.3}}. {{ozone.ssl.enabled.protocols}} keeps precedence, and an
explicit {{TLSv1.2}} (the case HDDS-15152 fixed) is still honored.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
