[HADOOP-14083] KMS should support old SSL clients

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.8.0, 2.7.4, 2.6.6
• Fix Version/s: 2.9.0
• Component/s: kms
• Target Version/s: 2.9.0
• Hadoop Flags: Reviewed
• Assignee: John Zhuge
• Reporter: John Zhuge
• Created: 15/Feb/17 18:25
• Updated: 12/May/17 14:21
• Resolved: 28/Feb/17 02:18

Description

HADOOP-13812 upgraded Tomcat to 6.0.48 which filters weak ciphers. Old SSL clients such as curl stop working. The symptom is NSS error -12286 when running curl -v.

Instead of forcing the SSL clients to upgrade, we can configure Tomcat to explicitly allow enough weak ciphers so that old SSL clients can work.

Issue Links

• breaks: HADOOP-14131 kms.sh creates bogus dir for tomcat logs
• is broken by: HADOOP-13812 Upgrade Tomcat to 6.0.48
• is depended upon by: HADOOP-14242 Make KMS Tomcat SSL property sslEnabledProtocols and clientAuth configurable
• is depended upon by: HADOOP-14141 Store KMS SSL keystore password in catalina.properties
• is depended upon by: HADOOP-14417 Update default SSL cipher list for KMS
• is related to: HDFS-11418 HttpFS should support old SSL clients