Uploaded image for project: 'Hadoop Common'
  1. Hadoop Common
  2. HADOOP-14083

KMS should support old SSL clients

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Resolved
    • Minor
    • Resolution: Fixed
    • 2.8.0, 2.7.4, 2.6.6
    • 2.9.0
    • kms
    • None
    • Reviewed

    Description

      HADOOP-13812 upgraded Tomcat to 6.0.48 which filters weak ciphers. Old SSL clients such as curl stop working. The symptom is NSS error -12286 when running curl -v.

      Instead of forcing the SSL clients to upgrade, we can configure Tomcat to explicitly allow enough weak ciphers so that old SSL clients can work.

      Attachments

        1. HADOOP-14083.branch-2.001.patch
          5 kB
          John Zhuge
        2. HADOOP-14083.branch-2.002.patch
          14 kB
          John Zhuge

        Issue Links

          breaks

          Bug - A problem which impairs or prevents the functions of the product. HADOOP-14131 kms.sh creates bogus dir for tomcat logs

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Resolved
          is broken by

          Bug - A problem which impairs or prevents the functions of the product. HADOOP-13812 Upgrade Tomcat to 6.0.48

          • Blocker - Blocks development and/or testing work, production could not run
          • Resolved
          is depended upon by

          Improvement - An improvement or enhancement to an existing feature or task. HADOOP-14242 Make KMS Tomcat SSL property sslEnabledProtocols and clientAuth configurable

          • Major - Major loss of function.
          • Resolved

          Improvement - An improvement or enhancement to an existing feature or task. HADOOP-14141 Store KMS SSL keystore password in catalina.properties

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Resolved

          Improvement - An improvement or enhancement to an existing feature or task. HADOOP-14417 Update default SSL cipher list for KMS

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Resolved
          is related to

          Improvement - An improvement or enhancement to an existing feature or task. HDFS-11418 HttpFS should support old SSL clients

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Resolved

          Activity

            People

              jzhuge John Zhuge
              jzhuge John Zhuge
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: