[
https://issues.apache.org/jira/browse/PHOENIX-7976?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18110624#comment-18110624
]
ASF GitHub Bot commented on PHOENIX-7976:
-----------------------------------------
PDavid opened a new pull request, #194:
URL: https://github.com/apache/phoenix-queryserver/pull/194
To maintain compatibility assume that the current parameters are still
Dual-purpose EKU certs and introduce new parameters. Fall back to the old
parameters if the new one is not available.
Current params:
"phoenix.queryserver.tls.keystore";
"phoenix.queryserver.tls.truststore.password";
"phoenix.queryserver.tls.keystore.password";
"phoenix.queryserver.tls.truststore";
New proposed parameters:
"phoenix.queryserver.tls.server.keystore";
"phoenix.queryserver.tls.server.keystore.password";
"phoenix.queryserver.tls.server.truststore";
"phoenix.queryserver.tls.server.truststore.password";
> Introduce new parameters to support single-purpose Extended Key Usage (EKU)
> certificates
> ----------------------------------------------------------------------------------------
>
> Key: PHOENIX-7976
> URL: https://issues.apache.org/jira/browse/PHOENIX-7976
> Project: Phoenix
> Issue Type: Task
> Components: queryserver
> Reporter: Richárd Antal
> Assignee: Dávid Paksy
> Priority: Major
>
> Add support single-purpose Extended Key Usage (EKU) certificates so that It
> can maintain cluster security using certificates issued by public and modern
> corporate CAs.
> Industry standards and public CAs (specifically DigiCert) are sunsetting
> multi-use certificates that contain both serverAuth and clientAuth.
> Update validation logic to accept serverAuth-only certs for server roles and
> clientAuth-only certs for mTLS roles.
> --------------
> To maintain compatibility assume that the current parameters are still
> Dual-popuse EKU certs and introduce new parameters.
> Fall back to the old parameters if the new one is not available.
> Current params:
> "phoenix.queryserver.tls.keystore";
> "phoenix.queryserver.tls.truststore.password";
> "phoenix.queryserver.tls.keystore.password";
> "phoenix.queryserver.tls.truststore";
> New proposed parameters:
> "phoenix.queryserver.tls.server.keystore";
> "phoenix.queryserver.tls.server.keystore.password";
> "phoenix.queryserver.tls.server.truststore";
> "phoenix.queryserver.tls.server.truststore.password";
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
