[CASSANDRA-14223] Provide ability to do custom certificate validations (e.g. hostname validation, certificate revocation checks)

• Type: Improvement
• Status: Open
• Priority: Normal
• Resolution: Unresolved
• Fix Version/s: 5.x
• Component/s: Local/Config
• Labels: security
• Assignee: Unassigned
• Reporter: Ron Blechman
• Created: 08/Feb/18 03:13
• Updated: 07/Mar/23 10:53

Description

Cassandra server should be to be able do additional certificate validations, such as hostname validatation and certificate revocation checking against CRLs and/or using OCSP. 

One approach couild be to have SSLFactory use SSLContext.getDefault() instead of forcing the creation of a new SSLContext using SSLContext.getInstance().  Using the default SSLContext would allow a user to plug in their own custom SSLSocketFactory via the java.security properties file. The custom SSLSocketFactory could create a default SSLContext  that was customized to do any extra validation such as certificate revocation, host name validation, etc.

Issue Links

• relates to: CASSANDRA-13314 Config file based SSL settings