[FLINK-9310] Update default cyphersuites

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.4.2
• Fix Version/s: 1.5.0
• Component/s: Runtime / Coordination

Release Note

Due to a limitation in Netty's SsLHandler (v4.0.27), it does not work well together with GCM enabled cypher suites. It can cause transmission failures between Flink TaskManager's which manifest in a LocalTransportException. Therefore, it is highly recommended to set the {{security.ssl.algorithms}} configuration to TLS_RSA_WITH_AES_128_CBC_SHA when enabling ssl encryption between TaskManagers.

• Assignee: Stephan Ewen
• Reporter: Stephan Ewen
• Created: 07/May/18 17:44
• Updated: 27/Apr/21 18:06
• Resolved: 25/May/18 08:48

Description

The current default cipher suite TLS_RSA_WITH_AES_128_CBC_SHA is no longer recommended.

RFC 7525 [1] recommends to use the following cipher suites only:

• TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

[1] https://tools.ietf.org/html/rfc7525

Issue Links

• relates to: FLINK-9437 Revert cypher suite update
• links to: GitHub Pull Request #5965