[CASSANDRA-18951] Add option for MutualTlsAuthenticator to restrict the certificate validity period

• Type: New Feature
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 5.1
• Component/s: Feature/Authorization, Messaging/Client, Observability/JMX, Observability/Metrics
• Change Category: Operability
• Complexity: Normal
• Platform: All

Source Control Link

https://github.com/apache/cassandra/commit/a0af41f666c23a840d9df3f06729ed5fd2c06cd1

Test and Documentation Plan

Added tests to validate that the age restrictions are enforced.

• Assignee: Francisco Guerrero
• Reporter: Francisco Guerrero

Authors

Francisco Guerrero

Reviewers

Abe Ratnofsky, Andy Tolbert, Dinesh Joshi

• Created: 20/Oct/23 18:15
• Updated: 08/Apr/24 11:48
• Resolved: 26/Mar/24 00:00

Description

In org.apache.cassandra.auth.MutualTlsAuthenticator, we validate that a certificate is valid by looking at the identities inside the
certificate and making sure the identity exists in the identity to role table.

In some situations we may want to restrict the certificates
we accept by rejecting certificates older than x amount of days. Some certificates can be generated with long expiration dates,
and this might be undesired when you want to protect against potential certificates being compromised. For that reason, it is
important to add an option, that when configured, we can limit the age of the certificate we accept for mTLS authentication.

When enabled, this will force clients to have to renew certificates more frequently, reducing the exposure of a Cassandra cluster
to leaked certificates.

Issue Links

• links to: GitHub Pull Request #3109