Impala Public Jenkins has submitted this change and it was merged. (
http://gerrit.cloudera.org:8080/24666 )
Change subject: IMPALA-15249: Update test certificates to use serverAuth EKU
only
......................................................................
IMPALA-15249: Update test certificates to use serverAuth EKU only
Impala's test certificates in be/src/testutil/ previously had no Extended
Key Usage (EKU) extension. An absent EKU means all uses are permitted.
Industry standards and public CAs are sunsetting multi-use certificates.
To align Impala's tests with real-world PKI practices, test certificates
should use serverAuth EKU rather than dual EKU.
This change regenerates the five leaf certificate families used by
Impala's TLS tests to carry EKU=serverAuth only. Impala never presents
its certificate in a TLS client role. Every code path that loads
--ssl_server_certificate uses the cert only in the TLS server role
during the handshake, so clientAuth is intentionally omitted.
Regenerated leaves (EKU=serverAuth only):
- server-cert.pem + server-key.pem + server-key-password.pem
- localhost.pem + localhost.key
- localhost-ecdsa.pem + localhost-ecdsa.key
- wildcard-cert.pem + wildcard-cert.key
- wildcard-san-cert.pem + wildcard-san-cert.key
Not regenerated:
- CA certs: wildcardCA.pem, wildcardCA-ecdsa.pem
- Negative-path certs: bad-cert.pem, future-cert.pem,
invalid-server-cert.pem, incorrect-commonname-cert.pem
Testing:
- Existing SSL-related unit tests and E2E tests passed with the
newly generated certificates
Assisted-by: Claude Opus 5 (Claude Code)
Change-Id: Icd1e8f685db5ace524e0c705bc25eba784a1d155
Reviewed-on: http://gerrit.cloudera.org:8080/24666
Reviewed-by: Impala Public Jenkins <[email protected]>
Tested-by: Impala Public Jenkins <[email protected]>
---
M be/src/testutil/certificates-info.txt
M be/src/testutil/localhost-ecdsa.key
M be/src/testutil/localhost-ecdsa.pem
M be/src/testutil/localhost.key
M be/src/testutil/localhost.pem
M be/src/testutil/server-cert.pem
M be/src/testutil/server-key-password.pem
M be/src/testutil/server-key.pem
M be/src/testutil/wildcard-cert.key
M be/src/testutil/wildcard-cert.pem
M be/src/testutil/wildcard-san-cert.key
M be/src/testutil/wildcard-san-cert.pem
12 files changed, 291 insertions(+), 232 deletions(-)
Approvals:
Impala Public Jenkins: Looks good to me, approved; Verified
--
To view, visit http://gerrit.cloudera.org:8080/24666
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: Icd1e8f685db5ace524e0c705bc25eba784a1d155
Gerrit-Change-Number: 24666
Gerrit-PatchSet: 4
Gerrit-Owner: Jiyoung Yoo <[email protected]>
Gerrit-Reviewer: Csaba Ringhofer <[email protected]>
Gerrit-Reviewer: Impala Public Jenkins <[email protected]>
Gerrit-Reviewer: Jason Fehr <[email protected]>
Gerrit-Reviewer: Jiyoung Yoo <[email protected]>
Gerrit-Reviewer: Yida Wu <[email protected]>
