[
https://issues.apache.org/jira/browse/RATIS-2596?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18095974#comment-18095974
]
Tsz-wo Sze commented on RATIS-2596:
-----------------------------------
[~haonan], let's also pass CipherSuiteFilter to the TlsConf. Filed RATIS-2602
> Unsupported TLS cipher suites may crash gRPC servers
> ----------------------------------------------------
>
> Key: RATIS-2596
> URL: https://issues.apache.org/jira/browse/RATIS-2596
> Project: Ratis
> Issue Type: Improvement
> Components: gRPC
> Affects Versions: 3.3.0
> Reporter: István Fajth
> Assignee: István Fajth
> Priority: Major
> Fix For: 3.3.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> In HDDS-15176 we realized that letting the SSL ciphers to be configured for
> gRPC with Netty can lead to misconfiguration where a cipher that is not
> supported by Netty is configured, and that crashed the gRPC endpoint in Ozone.
> In order to avoid similar situations in Ratis, I propose to change from the
> IdentityCipherSuiteFilter to the SupportedCipherSuiteFilter in the gRPC TLS
> setup in GrpcUtil#configureSslContextBuilder.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
