Uploaded image for project: 'Cassandra'
  1. Cassandra
  2. CASSANDRA-9220

Hostname verification for node-to-node encryption

Agile BoardAttach filesAttach ScreenshotBulk Copy AttachmentsBulk Move AttachmentsVotersWatch issueWatchersCreate sub-taskConvert to sub-taskMoveLinkCloneLabelsUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    • New Feature
    • Status: Resolved
    • Normal
    • Resolution: Fixed
    • 3.6
    • None

    Description

      This patch will will introduce a new ssl server option: require_endpoint_verification.

      Setting it will enable hostname verification for inter-node SSL communication. This is necessary to prevent man-in-the-middle attacks when building a trust chain against a common CA. See here for background details.

      Clusters that solely rely on importing all node certificates into each trust store (as described here) are not effected.

      Clusters that use the same common CA to sign node certificates are potentially affected. In case the CA signing process will allow other parties to generate certs for different purposes, those certificates could in turn be used for MITM attacks. The provided patch will allow to enable hostname verification to make sure not only to check if the cert is valid but also if it has been created for the host that we're about to connect.

      Corresponding dtest: Test for CASSANDRA-9220

      Related patches from the client perspective: Java, Python

      Attachments

        Issue Links

        Activity

          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            spod Stefan Podkowinski Assign to me
            spod Stefan Podkowinski
            Stefan Podkowinski
            Robert Stupp
            Votes:
            0 Vote for this issue
            Watchers:
            9 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Slack

                Issue deployment